{"matches":[{"vulnerability":{"id":"GHSA-jfmj-5v4g-7637","dataSource":"https://github.com/advisories/GHSA-jfmj-5v4g-7637","namespace":"github:language:python","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-5569","https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd","https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae"],"description":"zipp Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-5569","epss":0.00236,"percentile":0.14617,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-5569","cwe":"CWE-835","source":"security@huntr.dev","type":"Secondary"}],"fix":{"versions":["3.19.1"],"state":"fixed","available":[{"version":"3.19.1","date":"2024-07-10","kind":"first-observed"}]},"advisories":[],"risk":0.13629},"relatedVulnerabilities":[{"id":"CVE-2024-5569","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5569","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd","https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae"],"description":"A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.","cvss":[{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-5569","epss":0.00236,"percentile":0.14617,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-5569","cwe":"CWE-835","source":"security@huntr.dev","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"zipp","version":"3.15.0"}},"found":{"vulnerabilityID":"GHSA-jfmj-5v4g-7637","versionConstraint":"<3.19.1 (python)"},"fix":{"suggestedVersion":"3.19.1"}}],"artifact":{"id":"pkg:pypi/zipp@3.15.0?package-id=6c3c5441f220a556","name":"zipp","version":"3.15.0","type":"python","locations":[{"path":"/python/extractor/poetry.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-zipp:python-zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:python-zipp:python_zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:python_zipp:python-zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:python_zipp:python_zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:python-zipp:zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:python_zipp:zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:zipp:python-zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:zipp:python_zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:python:zipp:3.15.0:*:*:*:*:*:*:*","cpe:2.3:a:zipp:zipp:3.15.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/zipp@3.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6w46-j5rx-g56g","dataSource":"https://github.com/advisories/GHSA-6w46-j5rx-g56g","namespace":"github:language:python","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-71176","https://github.com/pytest-dev/pytest/issues/13669","https://www.openwall.com/lists/oss-security/2026/01/21/5","https://github.com/pytest-dev/pytest/pull/14343","https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c","https://github.com/pytest-dev/pytest/releases/tag/9.0.3"],"description":"pytest has vulnerable tmpdir handling","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.8,"exploitabilityScore":2.6,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-71176","epss":0.00154,"percentile":0.04474,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-71176","cwe":"CWE-379","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":["9.0.3"],"state":"fixed","available":[{"version":"9.0.3","date":"2026-04-14","kind":"first-observed"}]},"advisories":[],"risk":0.09085999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-71176","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-71176","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pytest-dev/pytest/issues/13669","https://www.openwall.com/lists/oss-security/2026/01/21/5"],"description":"pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.8,"exploitabilityScore":2.6,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-71176","epss":0.00154,"percentile":0.04474,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-71176","cwe":"CWE-379","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pytest","version":"7.4.4"}},"found":{"vulnerabilityID":"GHSA-6w46-j5rx-g56g","versionConstraint":"<9.0.3 (python)"},"fix":{"suggestedVersion":"9.0.3"}}],"artifact":{"id":"pkg:pypi/pytest@7.4.4?package-id=299d6b76f298b126","name":"pytest","version":"7.4.4","type":"python","locations":[{"path":"/python/extractor/poetry.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pytest:python-pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:python-pytest:python_pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:python_pytest:python-pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:python_pytest:python_pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:pytest:python-pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:pytest:python_pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:python-pytest:pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:python_pytest:pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:pytest:pytest:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:python:pytest:7.4.4:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pytest@7.4.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-cxww-7g56-2vh6","dataSource":"https://github.com/advisories/GHSA-cxww-7g56-2vh6","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6","https://github.com/advisories/GHSA-6q32-hq47-5qq3","https://snyk.io/research/zip-slip-vulnerability","https://github.com/actions/download-artifact/releases/tag/v4.1.3"],"description":"@actions/download-artifact has an Arbitrary File Write via artifact extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"actions/download-artifact","version":"v4"}},"found":{"vulnerabilityID":"GHSA-cxww-7g56-2vh6","versionConstraint":">=4.0.0,<4.1.3 (unknown)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:github/actions/download-artifact@v4?package-id=ae83e7511bcefb9b","name":"actions/download-artifact","version":"v4","type":"github-action","locations":[{"path":"/.github/workflows/ql-for-ql-dataset_measure.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download_artifact:v4:*:*:*:*:*:*:*"],"purl":"pkg:github/actions/download-artifact@v4","upstreams":[]}}],"source":{"type":"file","target":"github/codeql"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:25.823808633Z"}}