@fabasoad/sarif-to-slack 0.2.5 → 1.1.0

package/test-data/sarif/osv-scanner-poetry.sarif

@@ -0,0 +1,1893 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "addresses": [],
+      "artifacts": [
+        {
+          "length": -1,
+          "location": {
+            "index": -1,
+            "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+          },
+          "parentIndex": -1,
+          "roles": []
+        }
+      ],
+      "graphs": [],
+      "invocations": [],
+      "language": "en-US",
+      "logicalLocations": [],
+      "newlineSequences": [
+        "\r\n",
+        "\n"
+      ],
+      "policies": [],
+      "redactionTokens": [],
+      "results": [
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2024-34069' (also known as 'CGA-4f6v-wx38-68gq', 'GHSA-2g68-c3qc-8985')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-34069",
+          "ruleIndex": 0,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'dnspython@2.0.0' is vulnerable to 'CVE-2023-29483' (also known as 'GHSA-3rq5-2g8h-59hc')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-29483",
+          "ruleIndex": 1,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask-cors@3.0.8' is vulnerable to 'CVE-2024-6866' (also known as 'GHSA-43qf-4rqw-9q2g')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-6866",
+          "ruleIndex": 2,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'ihatemoney@4.1.4' is vulnerable to 'CVE-2020-15120' (also known as 'PYSEC-2020-264', 'GHSA-67j9-c52g-w2q9')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-15120",
+          "ruleIndex": 3,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask-cors@3.0.8' is vulnerable to 'CVE-2024-6839' (also known as 'GHSA-7rxf-gvfg-47g4')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-6839",
+          "ruleIndex": 4,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask-cors@3.0.8' is vulnerable to 'CVE-2024-1681' (also known as 'GHSA-84pr-m4jr-85g5')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-1681",
+          "ruleIndex": 5,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask-cors@3.0.8' is vulnerable to 'CVE-2024-6844' (also known as 'GHSA-8vgw-p6qm-5gr7')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-6844",
+          "ruleIndex": 6,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'jinja2@2.10.1' is vulnerable to 'CVE-2025-27516' (also known as 'GHSA-cpwx-vrp4-4pq7')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-27516",
+          "ruleIndex": 7,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2024-49766' (also known as 'GHSA-f9vj-2wh5-fj8j')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-49766",
+          "ruleIndex": 8,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'jinja2@2.10.1' is vulnerable to 'CVE-2020-28493' (also known as 'PYSEC-2021-66', 'SNYK-PYTHON-JINJA2-1012994', 'GHSA-g3rq-g295-4j3m')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-28493",
+          "ruleIndex": 9,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'babel@2.8.0' is vulnerable to 'CVE-2021-42771' (also known as 'PYSEC-2021-421', 'GHSA-h4m5-qpfp-3mpv')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2021-42771",
+          "ruleIndex": 10,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'jinja2@2.10.1' is vulnerable to 'CVE-2024-22195' (also known as 'GHSA-h5c8-rqwp-cp95')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-22195",
+          "ruleIndex": 11,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'jinja2@2.10.1' is vulnerable to 'CVE-2024-34064' (also known as 'CGA-g5xx-83xq-8g5j', 'GHSA-h75v-3vvj-5mfj')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-34064",
+          "ruleIndex": 12,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2023-46136' (also known as 'PYSEC-2023-221', 'GHSA-hrfv-mqp8-q5rw')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-46136",
+          "ruleIndex": 13,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask-cors@3.0.8' is vulnerable to 'CVE-2024-6221' (also known as 'PYSEC-2024-71', 'GHSA-hxwh-jpp2-84pm')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-6221",
+          "ruleIndex": 14,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'idna@2.10' is vulnerable to 'CVE-2024-3651' (also known as 'PYSEC-2024-60', 'GHSA-jjg7-2v4v-x38h')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-3651",
+          "ruleIndex": 15,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask@1.1.1' is vulnerable to 'CVE-2023-30861' (also known as 'PYSEC-2023-62', 'GHSA-m2qf-hxjv-5gpq')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-30861",
+          "ruleIndex": 16,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'fastecdsa@2.1.3' is vulnerable to 'CVE-2024-21502' (also known as 'PYSEC-2024-39', 'GHSA-ph86-g9r3-5qw4')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-21502",
+          "ruleIndex": 17,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2023-23934' (also known as 'PYSEC-2023-57', 'GHSA-px8h-6qxv-m22q')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-23934",
+          "ruleIndex": 18,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'jinja2@2.10.1' is vulnerable to 'CVE-2024-56326' (also known as 'GHSA-q2x7-8rv6-6q7h')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-56326",
+          "ruleIndex": 19,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2024-49767' (also known as 'GHSA-q34m-jh98-gwm2')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-49767",
+          "ruleIndex": 20,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'mako@1.1.3' is vulnerable to 'CVE-2022-40023' (also known as 'PYSEC-2022-260', 'GHSA-v973-fxgf-6xhp')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2022-40023",
+          "ruleIndex": 21,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask-cors@3.0.8' is vulnerable to 'CVE-2020-25032' (also known as 'PYSEC-2020-43', 'GHSA-xc3p-ff3m-f46v')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-25032",
+          "ruleIndex": 22,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2023-25577' (also known as 'PYSEC-2023-58', 'GHSA-xg9f-g7g7-2323')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-25577",
+          "ruleIndex": 23,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'ihatemoney@4.1.4' is vulnerable to 'CVE-2020-15120' (also known as 'PYSEC-2020-264', 'GHSA-67j9-c52g-w2q9')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-15120",
+          "ruleIndex": 3,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask-cors@3.0.8' is vulnerable to 'CVE-2020-25032' (also known as 'PYSEC-2020-43', 'GHSA-xc3p-ff3m-f46v')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-25032",
+          "ruleIndex": 22,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'babel@2.8.0' is vulnerable to 'CVE-2021-42771' (also known as 'PYSEC-2021-421', 'GHSA-h4m5-qpfp-3mpv')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2021-42771",
+          "ruleIndex": 10,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'jinja2@2.10.1' is vulnerable to 'CVE-2020-28493' (also known as 'PYSEC-2021-66', 'SNYK-PYTHON-JINJA2-1012994', 'GHSA-g3rq-g295-4j3m')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-28493",
+          "ruleIndex": 9,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2022-29361' (also known as 'PYSEC-2022-203')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2022-29361",
+          "ruleIndex": 24,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'mako@1.1.3' is vulnerable to 'CVE-2022-40023' (also known as 'PYSEC-2022-260', 'GHSA-v973-fxgf-6xhp')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2022-40023",
+          "ruleIndex": 21,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2023-46136' (also known as 'PYSEC-2023-221', 'GHSA-hrfv-mqp8-q5rw')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-46136",
+          "ruleIndex": 13,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2023-23934' (also known as 'PYSEC-2023-57', 'GHSA-px8h-6qxv-m22q')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-23934",
+          "ruleIndex": 18,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'werkzeug@0.16.1' is vulnerable to 'CVE-2023-25577' (also known as 'PYSEC-2023-58', 'GHSA-xg9f-g7g7-2323')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-25577",
+          "ruleIndex": 23,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask@1.1.1' is vulnerable to 'CVE-2023-30861' (also known as 'PYSEC-2023-62', 'GHSA-m2qf-hxjv-5gpq')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-30861",
+          "ruleIndex": 16,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'fastecdsa@2.1.3' is vulnerable to 'CVE-2024-21502' (also known as 'PYSEC-2024-39', 'GHSA-ph86-g9r3-5qw4')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-21502",
+          "ruleIndex": 17,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'idna@2.10' is vulnerable to 'CVE-2024-3651' (also known as 'PYSEC-2024-60', 'GHSA-jjg7-2v4v-x38h')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-3651",
+          "ruleIndex": 15,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///Users/john.doe/projects/python/poetry/poetry.lock"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'flask-cors@3.0.8' is vulnerable to 'CVE-2024-6221' (also known as 'PYSEC-2024-71', 'GHSA-hxwh-jpp2-84pm')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-6221",
+          "ruleIndex": 14,
+          "stacks": [],
+          "taxa": []
+        }
+      ],
+      "runAggregates": [],
+      "taxonomies": [],
+      "threadFlowLocations": [],
+      "tool": {
+        "driver": {
+          "contents": [
+            "localizedData",
+            "nonLocalizedData"
+          ],
+          "informationUri": "https://github.com/google/osv-scanner",
+          "isComprehensive": false,
+          "language": "en-US",
+          "locations": [],
+          "name": "osv-scanner",
+          "notifications": [],
+          "rules": [
+            {
+              "deprecatedIds": [
+                "CVE-2024-34069",
+                "CGA-4f6v-wx38-68gq",
+                "GHSA-2g68-c3qc-8985"
+              ],
+              "fullDescription": {
+                "markdown": "The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.",
+                "text": "The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-34069](https://osv.dev/CVE-2024-34069)**.\n\n## [GHSA-2g68-c3qc-8985](https://osv.dev/GHSA-2g68-c3qc-8985)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-2g68-c3qc-8985 | werkzeug | 3.0.3 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34069\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-34069](https://osv.dev/CVE-2024-34069)**.\n\n## [GHSA-2g68-c3qc-8985](https://osv.dev/GHSA-2g68-c3qc-8985)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-2g68-c3qc-8985 | werkzeug | 3.0.3 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34069\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-34069",
+              "name": "CVE-2024-34069",
+              "properties": {
+                "security-severity": "7.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-34069: Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain",
+                "text": "CVE-2024-34069: Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2023-29483",
+                "GHSA-3rq5-2g8h-59hc"
+              ],
+              "fullDescription": {
+                "markdown": "eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a \"TuDoor\" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.",
+                "text": "eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a \"TuDoor\" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2023-29483](https://osv.dev/CVE-2023-29483)**.\n\n## [GHSA-3rq5-2g8h-59hc](https://osv.dev/GHSA-3rq5-2g8h-59hc)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a \"TuDoor\" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | dnspython | 2.0.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-3rq5-2g8h-59hc | eventlet | 0.35.2 |\n| GHSA-3rq5-2g8h-59hc | dnspython | 2.6.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-29483\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2023-29483](https://osv.dev/CVE-2023-29483)**.\n\n## [GHSA-3rq5-2g8h-59hc](https://osv.dev/GHSA-3rq5-2g8h-59hc)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a \"TuDoor\" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | dnspython | 2.0.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-3rq5-2g8h-59hc | eventlet | 0.35.2 |\n| GHSA-3rq5-2g8h-59hc | dnspython | 2.6.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-29483\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2023-29483",
+              "name": "CVE-2023-29483",
+              "properties": {
+                "security-severity": "5.9"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2023-29483: Potential DoS via the Tudoor mechanism in eventlet and dnspython",
+                "text": "CVE-2023-29483: Potential DoS via the Tudoor mechanism in eventlet and dnspython"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-6866",
+                "GHSA-43qf-4rqw-9q2g"
+              ],
+              "fullDescription": {
+                "markdown": "corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.",
+                "text": "corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-6866](https://osv.dev/CVE-2024-6866)**.\n\n## [GHSA-43qf-4rqw-9q2g](https://osv.dev/GHSA-43qf-4rqw-9q2g)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-43qf-4rqw-9q2g | flask-cors | 6.0.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6866\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-6866](https://osv.dev/CVE-2024-6866)**.\n\n## [GHSA-43qf-4rqw-9q2g](https://osv.dev/GHSA-43qf-4rqw-9q2g)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-43qf-4rqw-9q2g | flask-cors | 6.0.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6866\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-6866",
+              "name": "CVE-2024-6866",
+              "properties": {
+                "security-severity": "5.3"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-6866: Flask-CORS vulnerable to Improper Handling of Case Sensitivity",
+                "text": "CVE-2024-6866: Flask-CORS vulnerable to Improper Handling of Case Sensitivity"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2020-15120",
+                "PYSEC-2020-264",
+                "GHSA-67j9-c52g-w2q9"
+              ],
+              "fullDescription": {
+                "markdown": "### Impact\nAn authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code.\n\nWith the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated.\n\n### Patches\n```diff\n ihatemoney/models.py | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/ihatemoney/models.py b/ihatemoney/models.py\nindex fe7b519..5691c75 100644\n--- a/ihatemoney/models.py\n+++ b/ihatemoney/models.py\n@@ -380,7 +380,7 @@ class Person(db.Model):\n         def get_by_name(self, name, project):\n             return (\n                 Person.query.filter(Person.name == name)\n-                .filter(Project.id == project.id)\n+                .filter(Person.project_id == project.id)\n                 .one()\n             )\n \n@@ -389,7 +389,7 @@ class Person(db.Model):\n                 project = g.project\n             return (\n                 Person.query.filter(Person.id == id)\n-                .filter(Project.id == project.id)\n+                .filter(Person.project_id == project.id)\n                 .one()\n             )\n \n```\n\n### Workarounds\n\nTo limit the impact, it is possible to disable public project creation by setting `ALLOW_PUBLIC_PROJECT_CREATION = False` in the configuration (see [documentation](https://ihatemoney.readthedocs.io/en/latest/configuration.html)). Existing users will still be able to exploit the flaw, but this will prevent an external attacker from creating a new project.\n\n### For more information\n\n`Person.query.get()` and `Person.query.get_by_name()` were mistakenly running a database join on the Project table without constraining the result.\n\nAs a result, `Person.query.get(42, \"projectfoo\")` would return the Person with id=42, even if it is not associated to the project \"projectfoo\".  The only condition is that \"projectfoo\" must exist.\n\nThis flaw can be exploited in several places:\n\n1) API: PUT requests to `/api/projects/\u003cproject\u003e/members/\u003cpersonID\u003e` will succeed even though `\u003cpersonID\u003e` is not a member of `\u003cproject\u003e`.\n\n   This allows an authenticated attacker to alter the state of a member (name, weight, activated) in any project.  In addition, the altered member will no longer be associated with its original project but will be associated to the attacker project instead, breaking many features of IHateMoney.  For instance, bills referencing the altered member will no longer be visible in the original project.\n\n   This causes an additional information disclosure and loss of integrity on bills: the attacker will now be able to see, edit and delete bills belonging to the altered member, because IHateMoney now believes that these bills are associated to the attacker project through the altered member.\n\n   For instance, assume that `Person(id=42)` is a member of project \"targetProject\", and that the attacker has access to another project \"attackerProject\" with the private code \"attackerPassword\".  The attacker can modify `Person(id=42)` with this command:\n\n     $ curl -X PUT -d \"name=Pwn3d\u0026activated=1\" --basic -u attackerProject:attackerPassword http://$SERVER/api/projects/attackerProject/members/42\n\n   The attacker can now see, edit and delete bills paid by `Person(id=42)` by simply browsing to http://$SERVER/attackerProject/\n\n2) Editing a member through the web interface at `/\u003cproject\u003e/members/\u003cpersonID\u003e/edit` will succeed even though `\u003cpersonID\u003e` is not a member of `\u003cproject\u003e`.\n\n   This is very similar to the PUT exploit.  Reusing the same example, the attacker needs to login to its \"attackerProject\" project with the private code \"attackerPassword\".  It can then alter the state of `Person(id=42)` by accessing the edit form at the following URL:\n\n     http://$SERVER/attackerProject/members/42/edit\n\n   Again, as a result of the alteration, the altered member will become associated to the project \"attackerProject\", resulting in the same information disclosure and loss of integrity on bills.\n\n3) API: DELETE requests to `/api/projects/\u003cproject\u003e/members/\u003cpersonID\u003e` will similarly allow to delete the member `\u003cpersonID\u003e` even if it belongs to a different project than `\u003cproject\u003e`.\n\n     $ curl -X DELETE --basic -u attackerProject:attackerPassword http://$SERVER/api/projects/attackerProject/members/42\n\n   The impact is less serious than with PUT, because DELETE only deactivates a member (it does not really delete it).\n\nAll these exploits require authentication: an attacker needs to know a valid project name and its associated \"private code\".  Once this requirement is fullfilled, the attacker can exploit this flaw to alter the state of members in any other project, without needing to know the target project name or its private code.\n\n`Person.query.get_by_name()` suffers from the same issue as `Person.query.get()`.  It has an additional issue: if multiple Person objects with the same name exist (this is possible if they are associated to different projects), `get_by_name()` will crash with `MultipleResultsFound` because of the call to `one()`.\n\nHowever, since `Person.query.get_by_name()` is currently not used anywhere in IHateMoney, the bug affecting this function has no impact and is not exploitable.",
+                "text": "### Impact\nAn authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code.\n\nWith the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated.\n\n### Patches\n```diff\n ihatemoney/models.py | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/ihatemoney/models.py b/ihatemoney/models.py\nindex fe7b519..5691c75 100644\n--- a/ihatemoney/models.py\n+++ b/ihatemoney/models.py\n@@ -380,7 +380,7 @@ class Person(db.Model):\n         def get_by_name(self, name, project):\n             return (\n                 Person.query.filter(Person.name == name)\n-                .filter(Project.id == project.id)\n+                .filter(Person.project_id == project.id)\n                 .one()\n             )\n \n@@ -389,7 +389,7 @@ class Person(db.Model):\n                 project = g.project\n             return (\n                 Person.query.filter(Person.id == id)\n-                .filter(Project.id == project.id)\n+                .filter(Person.project_id == project.id)\n                 .one()\n             )\n \n```\n\n### Workarounds\n\nTo limit the impact, it is possible to disable public project creation by setting `ALLOW_PUBLIC_PROJECT_CREATION = False` in the configuration (see [documentation](https://ihatemoney.readthedocs.io/en/latest/configuration.html)). Existing users will still be able to exploit the flaw, but this will prevent an external attacker from creating a new project.\n\n### For more information\n\n`Person.query.get()` and `Person.query.get_by_name()` were mistakenly running a database join on the Project table without constraining the result.\n\nAs a result, `Person.query.get(42, \"projectfoo\")` would return the Person with id=42, even if it is not associated to the project \"projectfoo\".  The only condition is that \"projectfoo\" must exist.\n\nThis flaw can be exploited in several places:\n\n1) API: PUT requests to `/api/projects/\u003cproject\u003e/members/\u003cpersonID\u003e` will succeed even though `\u003cpersonID\u003e` is not a member of `\u003cproject\u003e`.\n\n   This allows an authenticated attacker to alter the state of a member (name, weight, activated) in any project.  In addition, the altered member will no longer be associated with its original project but will be associated to the attacker project instead, breaking many features of IHateMoney.  For instance, bills referencing the altered member will no longer be visible in the original project.\n\n   This causes an additional information disclosure and loss of integrity on bills: the attacker will now be able to see, edit and delete bills belonging to the altered member, because IHateMoney now believes that these bills are associated to the attacker project through the altered member.\n\n   For instance, assume that `Person(id=42)` is a member of project \"targetProject\", and that the attacker has access to another project \"attackerProject\" with the private code \"attackerPassword\".  The attacker can modify `Person(id=42)` with this command:\n\n     $ curl -X PUT -d \"name=Pwn3d\u0026activated=1\" --basic -u attackerProject:attackerPassword http://$SERVER/api/projects/attackerProject/members/42\n\n   The attacker can now see, edit and delete bills paid by `Person(id=42)` by simply browsing to http://$SERVER/attackerProject/\n\n2) Editing a member through the web interface at `/\u003cproject\u003e/members/\u003cpersonID\u003e/edit` will succeed even though `\u003cpersonID\u003e` is not a member of `\u003cproject\u003e`.\n\n   This is very similar to the PUT exploit.  Reusing the same example, the attacker needs to login to its \"attackerProject\" project with the private code \"attackerPassword\".  It can then alter the state of `Person(id=42)` by accessing the edit form at the following URL:\n\n     http://$SERVER/attackerProject/members/42/edit\n\n   Again, as a result of the alteration, the altered member will become associated to the project \"attackerProject\", resulting in the same information disclosure and loss of integrity on bills.\n\n3) API: DELETE requests to `/api/projects/\u003cproject\u003e/members/\u003cpersonID\u003e` will similarly allow to delete the member `\u003cpersonID\u003e` even if it belongs to a different project than `\u003cproject\u003e`.\n\n     $ curl -X DELETE --basic -u attackerProject:attackerPassword http://$SERVER/api/projects/attackerProject/members/42\n\n   The impact is less serious than with PUT, because DELETE only deactivates a member (it does not really delete it).\n\nAll these exploits require authentication: an attacker needs to know a valid project name and its associated \"private code\".  Once this requirement is fullfilled, the attacker can exploit this flaw to alter the state of members in any other project, without needing to know the target project name or its private code.\n\n`Person.query.get_by_name()` suffers from the same issue as `Person.query.get()`.  It has an additional issue: if multiple Person objects with the same name exist (this is possible if they are associated to different projects), `get_by_name()` will crash with `MultipleResultsFound` because of the call to `one()`.\n\nHowever, since `Person.query.get_by_name()` is currently not used anywhere in IHateMoney, the bug affecting this function has no impact and is not exploitable."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2020-15120](https://osv.dev/CVE-2020-15120)**\n(Also published as: [PYSEC-2020-264](https://osv.dev/PYSEC-2020-264), [GHSA-67j9-c52g-w2q9](https://osv.dev/GHSA-67j9-c52g-w2q9), ).\n\n## [PYSEC-2020-264](https://osv.dev/PYSEC-2020-264)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e In \"I hate money\" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5.\n\n\u003c/details\u003e\n\n## [GHSA-67j9-c52g-w2q9](https://osv.dev/GHSA-67j9-c52g-w2q9)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ### Impact\n\u003e An authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code.\n\u003e \n\u003e With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated.\n\u003e \n\u003e ### Patches\n\u003e ```diff\n\u003e  ihatemoney/models.py | 4 ++--\n\u003e  1 file changed, 2 insertions(+), 2 deletions(-)\n\u003e \n\u003e diff --git a/ihatemoney/models.py b/ihatemoney/models.py\n\u003e index fe7b519..5691c75 100644\n\u003e --- a/ihatemoney/models.py\n\u003e +++ b/ihatemoney/models.py\n\u003e @@ -380,7 +380,7 @@ class Person(db.Model):\n\u003e          def get_by_name(self, name, project):\n\u003e              return (\n\u003e                  Person.query.filter(Person.name == name)\n\u003e -                .filter(Project.id == project.id)\n\u003e +                .filter(Person.project_id == project.id)\n\u003e                  .one()\n\u003e              )\n\u003e  \n\u003e @@ -389,7 +389,7 @@ class Person(db.Model):\n\u003e                  project = g.project\n\u003e              return (\n\u003e                  Person.query.filter(Person.id == id)\n\u003e -                .filter(Project.id == project.id)\n\u003e +                .filter(Person.project_id == project.id)\n\u003e                  .one()\n\u003e              )\n\u003e  \n\u003e ```\n\u003e \n\u003e ### Workarounds\n\u003e \n\u003e To limit the impact, it is possible to disable public project creation by setting `ALLOW_PUBLIC_PROJECT_CREATION = False` in the configuration (see [documentation](https://ihatemoney.readthedocs.io/en/latest/configuration.html)). Existing users will still be able to exploit the flaw, but this will prevent an external attacker from creating a new project.\n\u003e \n\u003e ### For more information\n\u003e \n\u003e `Person.query.get()` and `Person.query.get_by_name()` were mistakenly running a database join on the Project table without constraining the result.\n\u003e \n\u003e As a result, `Person.query.get(42, \"projectfoo\")` would return the Person with id=42, even if it is not associated to the project \"projectfoo\".  The only condition is that \"projectfoo\" must exist.\n\u003e \n\u003e This flaw can be exploited in several places:\n\u003e \n\u003e 1) API: PUT requests to `/api/projects/\u003cproject\u003e/members/\u003cpersonID\u003e` will succeed even though `\u003cpersonID\u003e` is not a member of `\u003cproject\u003e`.\n\u003e \n\u003e    This allows an authenticated attacker to alter the state of a member (name, weight, activated) in any project.  In addition, the altered member will no longer be associated with its original project but will be associated to the attacker project instead, breaking many features of IHateMoney.  For instance, bills referencing the altered member will no longer be visible in the original project.\n\u003e \n\u003e    This causes an additional information disclosure and loss of integrity on bills: the attacker will now be able to see, edit and delete bills belonging to the altered member, because IHateMoney now believes that these bills are associated to the attacker project through the altered member.\n\u003e \n\u003e    For instance, assume that `Person(id=42)` is a member of project \"targetProject\", and that the attacker has access to another project \"attackerProject\" with the private code \"attackerPassword\".  The attacker can modify `Person(id=42)` with this command:\n\u003e \n\u003e      $ curl -X PUT -d \"name=Pwn3d\u0026activated=1\" --basic -u attackerProject:attackerPassword http://$SERVER/api/projects/attackerProject/members/42\n\u003e \n\u003e    The attacker can now see, edit and delete bills paid by `Person(id=42)` by simply browsing to http://$SERVER/attackerProject/\n\u003e \n\u003e 2) Editing a member through the web interface at `/\u003cproject\u003e/members/\u003cpersonID\u003e/edit` will succeed even though `\u003cpersonID\u003e` is not a member of `\u003cproject\u003e`.\n\u003e \n\u003e    This is very similar to the PUT exploit.  Reusing the same example, the attacker needs to login to its \"attackerProject\" project with the private code \"attackerPassword\".  It can then alter the state of `Person(id=42)` by accessing the edit form at the following URL:\n\u003e \n\u003e      http://$SERVER/attackerProject/members/42/edit\n\u003e \n\u003e    Again, as a result of the alteration, the altered member will become associated to the project \"attackerProject\", resulting in the same information disclosure and loss of integrity on bills.\n\u003e \n\u003e 3) API: DELETE requests to `/api/projects/\u003cproject\u003e/members/\u003cpersonID\u003e` will similarly allow to delete the member `\u003cpersonID\u003e` even if it belongs to a different project than `\u003cproject\u003e`.\n\u003e \n\u003e      $ curl -X DELETE --basic -u attackerProject:attackerPassword http://$SERVER/api/projects/attackerProject/members/42\n\u003e \n\u003e    The impact is less serious than with PUT, because DELETE only deactivates a member (it does not really delete it).\n\u003e \n\u003e All these exploits require authentication: an attacker needs to know a valid project name and its associated \"private code\".  Once this requirement is fullfilled, the attacker can exploit this flaw to alter the state of members in any other project, without needing to know the target project name or its private code.\n\u003e \n\u003e `Person.query.get_by_name()` suffers from the same issue as `Person.query.get()`.  It has an additional issue: if multiple Person objects with the same name exist (this is possible if they are associated to different projects), `get_by_name()` will crash with `MultipleResultsFound` because of the call to `one()`.\n\u003e \n\u003e However, since `Person.query.get_by_name()` is currently not used anywhere in IHateMoney, the bug affecting this function has no impact and is not exploitable.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | ihatemoney | 4.1.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-67j9-c52g-w2q9 | ihatemoney | 4.1.5 |\n| PYSEC-2020-264 | ihatemoney | 4.1.5, 8d77cf5d5646e1d2d8ded13f0660638f57e98471 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-15120\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2020-15120](https://osv.dev/CVE-2020-15120)**\n(Also published as: [PYSEC-2020-264](https://osv.dev/PYSEC-2020-264), [GHSA-67j9-c52g-w2q9](https://osv.dev/GHSA-67j9-c52g-w2q9), ).\n\n## [PYSEC-2020-264](https://osv.dev/PYSEC-2020-264)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e In \"I hate money\" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5.\n\n\u003c/details\u003e\n\n## [GHSA-67j9-c52g-w2q9](https://osv.dev/GHSA-67j9-c52g-w2q9)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ### Impact\n\u003e An authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code.\n\u003e \n\u003e With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated.\n\u003e \n\u003e ### Patches\n\u003e ```diff\n\u003e  ihatemoney/models.py | 4 ++--\n\u003e  1 file changed, 2 insertions(+), 2 deletions(-)\n\u003e \n\u003e diff --git a/ihatemoney/models.py b/ihatemoney/models.py\n\u003e index fe7b519..5691c75 100644\n\u003e --- a/ihatemoney/models.py\n\u003e +++ b/ihatemoney/models.py\n\u003e @@ -380,7 +380,7 @@ class Person(db.Model):\n\u003e          def get_by_name(self, name, project):\n\u003e              return (\n\u003e                  Person.query.filter(Person.name == name)\n\u003e -                .filter(Project.id == project.id)\n\u003e +                .filter(Person.project_id == project.id)\n\u003e                  .one()\n\u003e              )\n\u003e  \n\u003e @@ -389,7 +389,7 @@ class Person(db.Model):\n\u003e                  project = g.project\n\u003e              return (\n\u003e                  Person.query.filter(Person.id == id)\n\u003e -                .filter(Project.id == project.id)\n\u003e +                .filter(Person.project_id == project.id)\n\u003e                  .one()\n\u003e              )\n\u003e  \n\u003e ```\n\u003e \n\u003e ### Workarounds\n\u003e \n\u003e To limit the impact, it is possible to disable public project creation by setting `ALLOW_PUBLIC_PROJECT_CREATION = False` in the configuration (see [documentation](https://ihatemoney.readthedocs.io/en/latest/configuration.html)). Existing users will still be able to exploit the flaw, but this will prevent an external attacker from creating a new project.\n\u003e \n\u003e ### For more information\n\u003e \n\u003e `Person.query.get()` and `Person.query.get_by_name()` were mistakenly running a database join on the Project table without constraining the result.\n\u003e \n\u003e As a result, `Person.query.get(42, \"projectfoo\")` would return the Person with id=42, even if it is not associated to the project \"projectfoo\".  The only condition is that \"projectfoo\" must exist.\n\u003e \n\u003e This flaw can be exploited in several places:\n\u003e \n\u003e 1) API: PUT requests to `/api/projects/\u003cproject\u003e/members/\u003cpersonID\u003e` will succeed even though `\u003cpersonID\u003e` is not a member of `\u003cproject\u003e`.\n\u003e \n\u003e    This allows an authenticated attacker to alter the state of a member (name, weight, activated) in any project.  In addition, the altered member will no longer be associated with its original project but will be associated to the attacker project instead, breaking many features of IHateMoney.  For instance, bills referencing the altered member will no longer be visible in the original project.\n\u003e \n\u003e    This causes an additional information disclosure and loss of integrity on bills: the attacker will now be able to see, edit and delete bills belonging to the altered member, because IHateMoney now believes that these bills are associated to the attacker project through the altered member.\n\u003e \n\u003e    For instance, assume that `Person(id=42)` is a member of project \"targetProject\", and that the attacker has access to another project \"attackerProject\" with the private code \"attackerPassword\".  The attacker can modify `Person(id=42)` with this command:\n\u003e \n\u003e      $ curl -X PUT -d \"name=Pwn3d\u0026activated=1\" --basic -u attackerProject:attackerPassword http://$SERVER/api/projects/attackerProject/members/42\n\u003e \n\u003e    The attacker can now see, edit and delete bills paid by `Person(id=42)` by simply browsing to http://$SERVER/attackerProject/\n\u003e \n\u003e 2) Editing a member through the web interface at `/\u003cproject\u003e/members/\u003cpersonID\u003e/edit` will succeed even though `\u003cpersonID\u003e` is not a member of `\u003cproject\u003e`.\n\u003e \n\u003e    This is very similar to the PUT exploit.  Reusing the same example, the attacker needs to login to its \"attackerProject\" project with the private code \"attackerPassword\".  It can then alter the state of `Person(id=42)` by accessing the edit form at the following URL:\n\u003e \n\u003e      http://$SERVER/attackerProject/members/42/edit\n\u003e \n\u003e    Again, as a result of the alteration, the altered member will become associated to the project \"attackerProject\", resulting in the same information disclosure and loss of integrity on bills.\n\u003e \n\u003e 3) API: DELETE requests to `/api/projects/\u003cproject\u003e/members/\u003cpersonID\u003e` will similarly allow to delete the member `\u003cpersonID\u003e` even if it belongs to a different project than `\u003cproject\u003e`.\n\u003e \n\u003e      $ curl -X DELETE --basic -u attackerProject:attackerPassword http://$SERVER/api/projects/attackerProject/members/42\n\u003e \n\u003e    The impact is less serious than with PUT, because DELETE only deactivates a member (it does not really delete it).\n\u003e \n\u003e All these exploits require authentication: an attacker needs to know a valid project name and its associated \"private code\".  Once this requirement is fullfilled, the attacker can exploit this flaw to alter the state of members in any other project, without needing to know the target project name or its private code.\n\u003e \n\u003e `Person.query.get_by_name()` suffers from the same issue as `Person.query.get()`.  It has an additional issue: if multiple Person objects with the same name exist (this is possible if they are associated to different projects), `get_by_name()` will crash with `MultipleResultsFound` because of the call to `one()`.\n\u003e \n\u003e However, since `Person.query.get_by_name()` is currently not used anywhere in IHateMoney, the bug affecting this function has no impact and is not exploitable.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | ihatemoney | 4.1.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-67j9-c52g-w2q9 | ihatemoney | 4.1.5 |\n| PYSEC-2020-264 | ihatemoney | 4.1.5, 8d77cf5d5646e1d2d8ded13f0660638f57e98471 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-15120\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2020-15120",
+              "name": "CVE-2020-15120",
+              "properties": {
+                "security-severity": "6.9"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2020-15120: Authorization Bypass in I hate money",
+                "text": "CVE-2020-15120: Authorization Bypass in I hate money"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-6839",
+                "GHSA-7rxf-gvfg-47g4"
+              ],
+              "fullDescription": {
+                "markdown": "corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.",
+                "text": "corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-6839](https://osv.dev/CVE-2024-6839)**.\n\n## [GHSA-7rxf-gvfg-47g4](https://osv.dev/GHSA-7rxf-gvfg-47g4)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-7rxf-gvfg-47g4 | flask-cors | 6.0.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6839\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-6839](https://osv.dev/CVE-2024-6839)**.\n\n## [GHSA-7rxf-gvfg-47g4](https://osv.dev/GHSA-7rxf-gvfg-47g4)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-7rxf-gvfg-47g4 | flask-cors | 6.0.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6839\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-6839",
+              "name": "CVE-2024-6839",
+              "properties": {
+                "security-severity": "4.3"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-6839: Flask-CORS improper regex path matching vulnerability",
+                "text": "CVE-2024-6839: Flask-CORS improper regex path matching vulnerability"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-1681",
+                "GHSA-84pr-m4jr-85g5"
+              ],
+              "fullDescription": {
+                "markdown": "corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.",
+                "text": "corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-1681](https://osv.dev/CVE-2024-1681)**.\n\n## [GHSA-84pr-m4jr-85g5](https://osv.dev/GHSA-84pr-m4jr-85g5)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-84pr-m4jr-85g5 | flask-cors | 4.0.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-1681\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-1681](https://osv.dev/CVE-2024-1681)**.\n\n## [GHSA-84pr-m4jr-85g5](https://osv.dev/GHSA-84pr-m4jr-85g5)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-84pr-m4jr-85g5 | flask-cors | 4.0.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-1681\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-1681",
+              "name": "CVE-2024-1681",
+              "properties": {
+                "security-severity": "5.3"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-1681: flask-cors vulnerable to log injection when the log level is set to debug",
+                "text": "CVE-2024-1681: flask-cors vulnerable to log injection when the log level is set to debug"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-6844",
+                "GHSA-8vgw-p6qm-5gr7"
+              ],
+              "fullDescription": {
+                "markdown": "A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.",
+                "text": "A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-6844](https://osv.dev/CVE-2024-6844)**.\n\n## [GHSA-8vgw-p6qm-5gr7](https://osv.dev/GHSA-8vgw-p6qm-5gr7)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-8vgw-p6qm-5gr7 | flask-cors | 6.0.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6844\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-6844](https://osv.dev/CVE-2024-6844)**.\n\n## [GHSA-8vgw-p6qm-5gr7](https://osv.dev/GHSA-8vgw-p6qm-5gr7)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-8vgw-p6qm-5gr7 | flask-cors | 6.0.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6844\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-6844",
+              "name": "CVE-2024-6844",
+              "properties": {
+                "security-severity": "5.3"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-6844: Flask-CORS allows for inconsistent CORS matching",
+                "text": "CVE-2024-6844: Flask-CORS allows for inconsistent CORS matching"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-27516",
+                "GHSA-cpwx-vrp4-4pq7"
+              ],
+              "fullDescription": {
+                "markdown": "An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.",
+                "text": "An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-27516](https://osv.dev/CVE-2025-27516)**.\n\n## [GHSA-cpwx-vrp4-4pq7](https://osv.dev/GHSA-cpwx-vrp4-4pq7)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.\n\u003e \n\u003e To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\u003e \n\u003e Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-cpwx-vrp4-4pq7 | jinja2 | 3.1.6 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-27516\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-27516](https://osv.dev/CVE-2025-27516)**.\n\n## [GHSA-cpwx-vrp4-4pq7](https://osv.dev/GHSA-cpwx-vrp4-4pq7)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.\n\u003e \n\u003e To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\u003e \n\u003e Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-cpwx-vrp4-4pq7 | jinja2 | 3.1.6 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-27516\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-27516",
+              "name": "CVE-2025-27516",
+              "properties": {
+                "security-severity": "5.4"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-27516: Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",
+                "text": "CVE-2025-27516: Jinja2 vulnerable to sandbox breakout through attr filter selecting format method"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-49766",
+                "GHSA-f9vj-2wh5-fj8j"
+              ],
+              "fullDescription": {
+                "markdown": "On Python \u003c 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug's `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python \u003e= 3.11, or not using Windows, are not vulnerable.",
+                "text": "On Python \u003c 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug's `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python \u003e= 3.11, or not using Windows, are not vulnerable."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-49766](https://osv.dev/CVE-2024-49766)**.\n\n## [GHSA-f9vj-2wh5-fj8j](https://osv.dev/GHSA-f9vj-2wh5-fj8j)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e On Python \u003c 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug's `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python \u003e= 3.11, or not using Windows, are not vulnerable.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-f9vj-2wh5-fj8j | werkzeug | 3.0.6 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-49766\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-49766](https://osv.dev/CVE-2024-49766)**.\n\n## [GHSA-f9vj-2wh5-fj8j](https://osv.dev/GHSA-f9vj-2wh5-fj8j)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e On Python \u003c 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug's `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python \u003e= 3.11, or not using Windows, are not vulnerable.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-f9vj-2wh5-fj8j | werkzeug | 3.0.6 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-49766\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-49766",
+              "name": "CVE-2024-49766",
+              "properties": {
+                "security-severity": "6.3"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-49766: Werkzeug safe_join not safe on Windows",
+                "text": "CVE-2024-49766: Werkzeug safe_join not safe on Windows"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2020-28493",
+                "PYSEC-2021-66",
+                "SNYK-PYTHON-JINJA2-1012994",
+                "GHSA-g3rq-g295-4j3m"
+              ],
+              "fullDescription": {
+                "markdown": "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.",
+                "text": "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2020-28493](https://osv.dev/CVE-2020-28493)**\n(Also published as: [PYSEC-2021-66](https://osv.dev/PYSEC-2021-66), [GHSA-g3rq-g295-4j3m](https://osv.dev/GHSA-g3rq-g295-4j3m), ).\n\n## [PYSEC-2021-66](https://osv.dev/PYSEC-2021-66)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.\n\n\u003c/details\u003e\n\n## [GHSA-g3rq-g295-4j3m](https://osv.dev/GHSA-g3rq-g295-4j3m)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-g3rq-g295-4j3m | jinja2 | 2.11.3 |\n| PYSEC-2021-66 | jinja2 | 2.11.3 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-28493\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2020-28493](https://osv.dev/CVE-2020-28493)**\n(Also published as: [PYSEC-2021-66](https://osv.dev/PYSEC-2021-66), [GHSA-g3rq-g295-4j3m](https://osv.dev/GHSA-g3rq-g295-4j3m), ).\n\n## [PYSEC-2021-66](https://osv.dev/PYSEC-2021-66)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.\n\n\u003c/details\u003e\n\n## [GHSA-g3rq-g295-4j3m](https://osv.dev/GHSA-g3rq-g295-4j3m)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-g3rq-g295-4j3m | jinja2 | 2.11.3 |\n| PYSEC-2021-66 | jinja2 | 2.11.3 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-28493\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2020-28493",
+              "name": "CVE-2020-28493",
+              "properties": {
+                "security-severity": "6.9"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2020-28493: Regular Expression Denial of Service (ReDoS) in Jinja2",
+                "text": "CVE-2020-28493: Regular Expression Denial of Service (ReDoS) in Jinja2"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2021-42771",
+                "PYSEC-2021-421",
+                "GHSA-h4m5-qpfp-3mpv"
+              ],
+              "fullDescription": {
+                "markdown": "Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.",
+                "text": "Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2021-42771](https://osv.dev/CVE-2021-42771)**\n(Also published as: [PYSEC-2021-421](https://osv.dev/PYSEC-2021-421), [GHSA-h4m5-qpfp-3mpv](https://osv.dev/GHSA-h4m5-qpfp-3mpv), ).\n\n## [PYSEC-2021-421](https://osv.dev/PYSEC-2021-421)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.\n\n\u003c/details\u003e\n\n## [GHSA-h4m5-qpfp-3mpv](https://osv.dev/GHSA-h4m5-qpfp-3mpv)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | babel | 2.8.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-h4m5-qpfp-3mpv | babel | 2.9.1 |\n| PYSEC-2021-421 | babel | 2.9.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2021-42771\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2021-42771](https://osv.dev/CVE-2021-42771)**\n(Also published as: [PYSEC-2021-421](https://osv.dev/PYSEC-2021-421), [GHSA-h4m5-qpfp-3mpv](https://osv.dev/GHSA-h4m5-qpfp-3mpv), ).\n\n## [PYSEC-2021-421](https://osv.dev/PYSEC-2021-421)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.\n\n\u003c/details\u003e\n\n## [GHSA-h4m5-qpfp-3mpv](https://osv.dev/GHSA-h4m5-qpfp-3mpv)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | babel | 2.8.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-h4m5-qpfp-3mpv | babel | 2.9.1 |\n| PYSEC-2021-421 | babel | 2.9.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2021-42771\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2021-42771",
+              "name": "CVE-2021-42771",
+              "properties": {
+                "security-severity": "8.7"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2021-42771: Directory Traversal in Babel",
+                "text": "CVE-2021-42771: Directory Traversal in Babel"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-22195",
+                "GHSA-h5c8-rqwp-cp95"
+              ],
+              "fullDescription": {
+                "markdown": "The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.",
+                "text": "The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-22195](https://osv.dev/CVE-2024-22195)**.\n\n## [GHSA-h5c8-rqwp-cp95](https://osv.dev/GHSA-h5c8-rqwp-cp95)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-h5c8-rqwp-cp95 | jinja2 | 3.1.3 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-22195\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-22195](https://osv.dev/CVE-2024-22195)**.\n\n## [GHSA-h5c8-rqwp-cp95](https://osv.dev/GHSA-h5c8-rqwp-cp95)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-h5c8-rqwp-cp95 | jinja2 | 3.1.3 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-22195\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-22195",
+              "name": "CVE-2024-22195",
+              "properties": {
+                "security-severity": "5.4"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-22195: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",
+                "text": "CVE-2024-22195: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-34064",
+                "CGA-g5xx-83xq-8g5j",
+                "GHSA-h75v-3vvj-5mfj"
+              ],
+              "fullDescription": {
+                "markdown": "The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `\u003e`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.\n\nAccepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.",
+                "text": "The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `\u003e`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.\n\nAccepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-34064](https://osv.dev/CVE-2024-34064)**.\n\n## [GHSA-h75v-3vvj-5mfj](https://osv.dev/GHSA-h75v-3vvj-5mfj)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `\u003e`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.\n\u003e \n\u003e Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-h75v-3vvj-5mfj | jinja2 | 3.1.4 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34064\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-34064](https://osv.dev/CVE-2024-34064)**.\n\n## [GHSA-h75v-3vvj-5mfj](https://osv.dev/GHSA-h75v-3vvj-5mfj)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `\u003e`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.\n\u003e \n\u003e Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-h75v-3vvj-5mfj | jinja2 | 3.1.4 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34064\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-34064",
+              "name": "CVE-2024-34064",
+              "properties": {
+                "security-severity": "5.4"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-34064: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",
+                "text": "CVE-2024-34064: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2023-46136",
+                "PYSEC-2023-221",
+                "GHSA-hrfv-mqp8-q5rw"
+              ],
+              "fullDescription": {
+                "markdown": "Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer.\n\nThis allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.\n",
+                "text": "Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer.\n\nThis allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.\n"
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2023-46136](https://osv.dev/CVE-2023-46136)**\n(Also published as: [PYSEC-2023-221](https://osv.dev/PYSEC-2023-221), [GHSA-hrfv-mqp8-q5rw](https://osv.dev/GHSA-hrfv-mqp8-q5rw), ).\n\n## [PYSEC-2023-221](https://osv.dev/PYSEC-2023-221)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.\n\n\u003c/details\u003e\n\n## [GHSA-hrfv-mqp8-q5rw](https://osv.dev/GHSA-hrfv-mqp8-q5rw)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer.\n\u003e \n\u003e This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.\n\u003e \n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-hrfv-mqp8-q5rw | werkzeug | 2.3.8, 3.0.1 |\n| PYSEC-2023-221 | werkzeug | 2.3.8, 3.0.1, f2300208d5e2a5076cbbb4c2aad71096fd040ef9, f3c803b3ade485a45f12b6d6617595350c0f03e2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-46136\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2023-46136](https://osv.dev/CVE-2023-46136)**\n(Also published as: [PYSEC-2023-221](https://osv.dev/PYSEC-2023-221), [GHSA-hrfv-mqp8-q5rw](https://osv.dev/GHSA-hrfv-mqp8-q5rw), ).\n\n## [PYSEC-2023-221](https://osv.dev/PYSEC-2023-221)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.\n\n\u003c/details\u003e\n\n## [GHSA-hrfv-mqp8-q5rw](https://osv.dev/GHSA-hrfv-mqp8-q5rw)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer.\n\u003e \n\u003e This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.\n\u003e \n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-hrfv-mqp8-q5rw | werkzeug | 2.3.8, 3.0.1 |\n| PYSEC-2023-221 | werkzeug | 2.3.8, 3.0.1, f2300208d5e2a5076cbbb4c2aad71096fd040ef9, f3c803b3ade485a45f12b6d6617595350c0f03e2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-46136\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2023-46136",
+              "name": "CVE-2023-46136",
+              "properties": {
+                "security-severity": "7.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2023-46136: Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning",
+                "text": "CVE-2023-46136: Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-6221",
+                "PYSEC-2024-71",
+                "GHSA-hxwh-jpp2-84pm"
+              ],
+              "fullDescription": {
+                "markdown": "A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.",
+                "text": "A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-6221](https://osv.dev/CVE-2024-6221)**\n(Also published as: [PYSEC-2024-71](https://osv.dev/PYSEC-2024-71), [GHSA-hxwh-jpp2-84pm](https://osv.dev/GHSA-hxwh-jpp2-84pm), ).\n\n## [PYSEC-2024-71](https://osv.dev/PYSEC-2024-71)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability in corydolphin/flask-cors up to version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.\n\n\u003c/details\u003e\n\n## [GHSA-hxwh-jpp2-84pm](https://osv.dev/GHSA-hxwh-jpp2-84pm)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-hxwh-jpp2-84pm | flask-cors | 4.0.2 |\n| PYSEC-2024-71 | flask-cors | 4.0.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6221\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-6221](https://osv.dev/CVE-2024-6221)**\n(Also published as: [PYSEC-2024-71](https://osv.dev/PYSEC-2024-71), [GHSA-hxwh-jpp2-84pm](https://osv.dev/GHSA-hxwh-jpp2-84pm), ).\n\n## [PYSEC-2024-71](https://osv.dev/PYSEC-2024-71)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability in corydolphin/flask-cors up to version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.\n\n\u003c/details\u003e\n\n## [GHSA-hxwh-jpp2-84pm](https://osv.dev/GHSA-hxwh-jpp2-84pm)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-hxwh-jpp2-84pm | flask-cors | 4.0.2 |\n| PYSEC-2024-71 | flask-cors | 4.0.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6221\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-6221",
+              "name": "CVE-2024-6221",
+              "properties": {
+                "security-severity": "8.7"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-6221: Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default",
+                "text": "CVE-2024-6221: Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-3651",
+                "PYSEC-2024-60",
+                "GHSA-jjg7-2v4v-x38h"
+              ],
+              "fullDescription": {
+                "markdown": "### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nThe function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\n### References\n* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb",
+                "text": "### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nThe function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\n### References\n* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-3651](https://osv.dev/CVE-2024-3651)**\n(Also published as: [PYSEC-2024-60](https://osv.dev/PYSEC-2024-60), [GHSA-jjg7-2v4v-x38h](https://osv.dev/GHSA-jjg7-2v4v-x38h), ).\n\n## [PYSEC-2024-60](https://osv.dev/PYSEC-2024-60)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.\n\n\u003c/details\u003e\n\n## [GHSA-jjg7-2v4v-x38h](https://osv.dev/GHSA-jjg7-2v4v-x38h)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ### Impact\n\u003e A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\u003e \n\u003e ### Patches\n\u003e The function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\u003e \n\u003e ### Workarounds\n\u003e Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\u003e \n\u003e ### References\n\u003e * https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | idna | 2.10 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-jjg7-2v4v-x38h | idna | 3.7 |\n| PYSEC-2024-60 | idna | 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d, 3.7 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-3651\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-3651](https://osv.dev/CVE-2024-3651)**\n(Also published as: [PYSEC-2024-60](https://osv.dev/PYSEC-2024-60), [GHSA-jjg7-2v4v-x38h](https://osv.dev/GHSA-jjg7-2v4v-x38h), ).\n\n## [PYSEC-2024-60](https://osv.dev/PYSEC-2024-60)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.\n\n\u003c/details\u003e\n\n## [GHSA-jjg7-2v4v-x38h](https://osv.dev/GHSA-jjg7-2v4v-x38h)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ### Impact\n\u003e A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\u003e \n\u003e ### Patches\n\u003e The function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\u003e \n\u003e ### Workarounds\n\u003e Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\u003e \n\u003e ### References\n\u003e * https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | idna | 2.10 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-jjg7-2v4v-x38h | idna | 3.7 |\n| PYSEC-2024-60 | idna | 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d, 3.7 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-3651\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-3651",
+              "name": "CVE-2024-3651",
+              "properties": {
+                "security-severity": "7.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-3651: Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode",
+                "text": "CVE-2024-3651: Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2023-30861",
+                "PYSEC-2023-62",
+                "GHSA-m2qf-hxjv-5gpq"
+              ],
+              "fullDescription": {
+                "markdown": "When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).\n2. The application does not access or modify the session at any point during a request.\n4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.",
+                "text": "When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).\n2. The application does not access or modify the session at any point during a request.\n4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2023-30861](https://osv.dev/CVE-2023-30861)**\n(Also published as: [PYSEC-2023-62](https://osv.dev/PYSEC-2023-62), [GHSA-m2qf-hxjv-5gpq](https://osv.dev/GHSA-m2qf-hxjv-5gpq), ).\n\n## [PYSEC-2023-62](https://osv.dev/PYSEC-2023-62)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\u003e \n\u003e 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n\u003e 2. The application sets `session.permanent = True`\n\u003e 3. The application does not access or modify the session at any point during a request.\n\u003e 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n\u003e 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\u003e \n\u003e This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.\n\n\u003c/details\u003e\n\n## [GHSA-m2qf-hxjv-5gpq](https://osv.dev/GHSA-m2qf-hxjv-5gpq)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.\n\u003e \n\u003e 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n\u003e 2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).\n\u003e 2. The application does not access or modify the session at any point during a request.\n\u003e 4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).\n\u003e 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\u003e \n\u003e This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask | 1.1.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-m2qf-hxjv-5gpq | flask | 2.2.5, 2.3.2 |\n| PYSEC-2023-62 | flask | 2.2.5, 2.3.2, 70f906c51ce49c485f1d355703e9cc3386b1cc2b, afd63b16170b7c047f5758eb910c416511e9c965 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-30861\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2023-30861](https://osv.dev/CVE-2023-30861)**\n(Also published as: [PYSEC-2023-62](https://osv.dev/PYSEC-2023-62), [GHSA-m2qf-hxjv-5gpq](https://osv.dev/GHSA-m2qf-hxjv-5gpq), ).\n\n## [PYSEC-2023-62](https://osv.dev/PYSEC-2023-62)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.\n\u003e \n\u003e 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n\u003e 2. The application sets `session.permanent = True`\n\u003e 3. The application does not access or modify the session at any point during a request.\n\u003e 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).\n\u003e 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\u003e \n\u003e This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.\n\n\u003c/details\u003e\n\n## [GHSA-m2qf-hxjv-5gpq](https://osv.dev/GHSA-m2qf-hxjv-5gpq)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.\n\u003e \n\u003e 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n\u003e 2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).\n\u003e 2. The application does not access or modify the session at any point during a request.\n\u003e 4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).\n\u003e 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\u003e \n\u003e This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask | 1.1.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-m2qf-hxjv-5gpq | flask | 2.2.5, 2.3.2 |\n| PYSEC-2023-62 | flask | 2.2.5, 2.3.2, 70f906c51ce49c485f1d355703e9cc3386b1cc2b, afd63b16170b7c047f5758eb910c416511e9c965 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-30861\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2023-30861",
+              "name": "CVE-2023-30861",
+              "properties": {
+                "security-severity": "8.7"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2023-30861: Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header",
+                "text": "CVE-2023-30861: Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-21502",
+                "PYSEC-2024-39",
+                "GHSA-ph86-g9r3-5qw4"
+              ],
+              "fullDescription": {
+                "markdown": "Versions of the package fastecdsa before 2.3.2 use an Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.",
+                "text": "Versions of the package fastecdsa before 2.3.2 use an Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-21502](https://osv.dev/CVE-2024-21502)**\n(Also published as: [PYSEC-2024-39](https://osv.dev/PYSEC-2024-39), [GHSA-ph86-g9r3-5qw4](https://osv.dev/GHSA-ph86-g9r3-5qw4), ).\n\n## [PYSEC-2024-39](https://osv.dev/PYSEC-2024-39)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.\n\n\u003c/details\u003e\n\n## [GHSA-ph86-g9r3-5qw4](https://osv.dev/GHSA-ph86-g9r3-5qw4)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Versions of the package fastecdsa before 2.3.2 use an Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | fastecdsa | 2.1.3 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-ph86-g9r3-5qw4 | fastecdsa | 2.3.2 |\n| PYSEC-2024-39 | fastecdsa | 2.3.2, 57fc5689c95d649dab7ef60cc99ac64589f01e36 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-21502\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-21502](https://osv.dev/CVE-2024-21502)**\n(Also published as: [PYSEC-2024-39](https://osv.dev/PYSEC-2024-39), [GHSA-ph86-g9r3-5qw4](https://osv.dev/GHSA-ph86-g9r3-5qw4), ).\n\n## [PYSEC-2024-39](https://osv.dev/PYSEC-2024-39)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.\n\n\u003c/details\u003e\n\n## [GHSA-ph86-g9r3-5qw4](https://osv.dev/GHSA-ph86-g9r3-5qw4)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Versions of the package fastecdsa before 2.3.2 use an Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | fastecdsa | 2.1.3 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-ph86-g9r3-5qw4 | fastecdsa | 2.3.2 |\n| PYSEC-2024-39 | fastecdsa | 2.3.2, 57fc5689c95d649dab7ef60cc99ac64589f01e36 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-21502\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-21502",
+              "name": "CVE-2024-21502",
+              "properties": {
+                "security-severity": "7.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-21502: Uninitialized Variable in fastecdsa",
+                "text": "CVE-2024-21502: Uninitialized Variable in fastecdsa"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2023-23934",
+                "PYSEC-2023-57",
+                "GHSA-px8h-6qxv-m22q"
+              ],
+              "fullDescription": {
+                "markdown": "Browsers may allow \"nameless\" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.\n\nWerkzeug \u003c= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.",
+                "text": "Browsers may allow \"nameless\" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.\n\nWerkzeug \u003c= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2023-23934](https://osv.dev/CVE-2023-23934)**\n(Also published as: [PYSEC-2023-57](https://osv.dev/PYSEC-2023-57), [GHSA-px8h-6qxv-m22q](https://osv.dev/GHSA-px8h-6qxv-m22q), ).\n\n## [PYSEC-2023-57](https://osv.dev/PYSEC-2023-57)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug is a comprehensive WSGI web application library. Browsers may allow \"nameless\" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.\n\n\u003c/details\u003e\n\n## [GHSA-px8h-6qxv-m22q](https://osv.dev/GHSA-px8h-6qxv-m22q)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Browsers may allow \"nameless\" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.\n\u003e \n\u003e Werkzeug \u003c= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-px8h-6qxv-m22q | werkzeug | 2.2.3 |\n| PYSEC-2023-57 | werkzeug | 2.2.3, cf275f42acad1b5950c50ffe8ef58fe62cdce028 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-23934\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2023-23934](https://osv.dev/CVE-2023-23934)**\n(Also published as: [PYSEC-2023-57](https://osv.dev/PYSEC-2023-57), [GHSA-px8h-6qxv-m22q](https://osv.dev/GHSA-px8h-6qxv-m22q), ).\n\n## [PYSEC-2023-57](https://osv.dev/PYSEC-2023-57)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug is a comprehensive WSGI web application library. Browsers may allow \"nameless\" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.\n\n\u003c/details\u003e\n\n## [GHSA-px8h-6qxv-m22q](https://osv.dev/GHSA-px8h-6qxv-m22q)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Browsers may allow \"nameless\" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.\n\u003e \n\u003e Werkzeug \u003c= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-px8h-6qxv-m22q | werkzeug | 2.2.3 |\n| PYSEC-2023-57 | werkzeug | 2.2.3, cf275f42acad1b5950c50ffe8ef58fe62cdce028 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-23934\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2023-23934",
+              "name": "CVE-2023-23934",
+              "properties": {
+                "security-severity": "2.6"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2023-23934: Incorrect parsing of nameless cookies leads to __Host- cookies bypass",
+                "text": "CVE-2023-23934: Incorrect parsing of nameless cookies leads to __Host- cookies bypass"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-56326",
+                "GHSA-q2x7-8rv6-6q7h"
+              ],
+              "fullDescription": {
+                "markdown": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",
+                "text": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-56326](https://osv.dev/CVE-2024-56326)**.\n\n## [GHSA-q2x7-8rv6-6q7h](https://osv.dev/GHSA-q2x7-8rv6-6q7h)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\u003e \n\u003e To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\u003e \n\u003e Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-q2x7-8rv6-6q7h | jinja2 | 3.1.5 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-56326\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-56326](https://osv.dev/CVE-2024-56326)**.\n\n## [GHSA-q2x7-8rv6-6q7h](https://osv.dev/GHSA-q2x7-8rv6-6q7h)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\u003e \n\u003e To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\u003e \n\u003e Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | jinja2 | 2.10.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-q2x7-8rv6-6q7h | jinja2 | 3.1.5 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-56326\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-56326",
+              "name": "CVE-2024-56326",
+              "properties": {
+                "security-severity": "7.8"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-56326: Jinja has a sandbox breakout through indirect reference to format method",
+                "text": "CVE-2024-56326: Jinja has a sandbox breakout through indirect reference to format method"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-49767",
+                "GHSA-q34m-jh98-gwm2"
+              ],
+              "fullDescription": {
+                "markdown": "Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\n\nThe `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.",
+                "text": "Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\n\nThe `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-49767](https://osv.dev/CVE-2024-49767)**.\n\n## [GHSA-q34m-jh98-gwm2](https://osv.dev/GHSA-q34m-jh98-gwm2)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\u003e \n\u003e \n\u003e The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-q34m-jh98-gwm2 | werkzeug | 3.0.6 |\n| GHSA-q34m-jh98-gwm2 | quart | 0.20.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-49767\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-49767](https://osv.dev/CVE-2024-49767)**.\n\n## [GHSA-q34m-jh98-gwm2](https://osv.dev/GHSA-q34m-jh98-gwm2)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\u003e \n\u003e \n\u003e The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-q34m-jh98-gwm2 | werkzeug | 3.0.6 |\n| GHSA-q34m-jh98-gwm2 | quart | 0.20.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-49767\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-49767",
+              "name": "CVE-2024-49767",
+              "properties": {
+                "security-severity": "7.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-49767: Werkzeug possible resource exhaustion when parsing file data in forms",
+                "text": "CVE-2024-49767: Werkzeug possible resource exhaustion when parsing file data in forms"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2022-40023",
+                "PYSEC-2022-260",
+                "GHSA-v973-fxgf-6xhp"
+              ],
+              "fullDescription": {
+                "markdown": "Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.",
+                "text": "Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2022-40023](https://osv.dev/CVE-2022-40023)**\n(Also published as: [PYSEC-2022-260](https://osv.dev/PYSEC-2022-260), [GHSA-v973-fxgf-6xhp](https://osv.dev/GHSA-v973-fxgf-6xhp), ).\n\n## [PYSEC-2022-260](https://osv.dev/PYSEC-2022-260)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.\n\n\u003c/details\u003e\n\n## [GHSA-v973-fxgf-6xhp](https://osv.dev/GHSA-v973-fxgf-6xhp)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | mako | 1.1.3 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-v973-fxgf-6xhp | mako | 1.2.2 |\n| PYSEC-2022-260 | mako | 1.2.2, 925760291d6efec64fda6e9dd1fd9cfbd5be068c |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2022-40023\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2022-40023](https://osv.dev/CVE-2022-40023)**\n(Also published as: [PYSEC-2022-260](https://osv.dev/PYSEC-2022-260), [GHSA-v973-fxgf-6xhp](https://osv.dev/GHSA-v973-fxgf-6xhp), ).\n\n## [PYSEC-2022-260](https://osv.dev/PYSEC-2022-260)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.\n\n\u003c/details\u003e\n\n## [GHSA-v973-fxgf-6xhp](https://osv.dev/GHSA-v973-fxgf-6xhp)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | mako | 1.1.3 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-v973-fxgf-6xhp | mako | 1.2.2 |\n| PYSEC-2022-260 | mako | 1.2.2, 925760291d6efec64fda6e9dd1fd9cfbd5be068c |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2022-40023\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2022-40023",
+              "name": "CVE-2022-40023",
+              "properties": {
+                "security-severity": "8.7"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2022-40023: mako is vulnerable to Regular Expression Denial of Service",
+                "text": "CVE-2022-40023: mako is vulnerable to Regular Expression Denial of Service"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2020-25032",
+                "PYSEC-2020-43",
+                "GHSA-xc3p-ff3m-f46v"
+              ],
+              "fullDescription": {
+                "markdown": "An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows `../` directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.",
+                "text": "An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows `../` directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2020-25032](https://osv.dev/CVE-2020-25032)**\n(Also published as: [PYSEC-2020-43](https://osv.dev/PYSEC-2020-43), [GHSA-xc3p-ff3m-f46v](https://osv.dev/GHSA-xc3p-ff3m-f46v), ).\n\n## [PYSEC-2020-43](https://osv.dev/PYSEC-2020-43)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.\n\n\u003c/details\u003e\n\n## [GHSA-xc3p-ff3m-f46v](https://osv.dev/GHSA-xc3p-ff3m-f46v)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows `../` directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-xc3p-ff3m-f46v | flask-cors | 3.0.9 |\n| PYSEC-2020-43 | flask-cors | 3.0.9 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-25032\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2020-25032](https://osv.dev/CVE-2020-25032)**\n(Also published as: [PYSEC-2020-43](https://osv.dev/PYSEC-2020-43), [GHSA-xc3p-ff3m-f46v](https://osv.dev/GHSA-xc3p-ff3m-f46v), ).\n\n## [PYSEC-2020-43](https://osv.dev/PYSEC-2020-43)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.\n\n\u003c/details\u003e\n\n## [GHSA-xc3p-ff3m-f46v](https://osv.dev/GHSA-xc3p-ff3m-f46v)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows `../` directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | flask-cors | 3.0.8 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-xc3p-ff3m-f46v | flask-cors | 3.0.9 |\n| PYSEC-2020-43 | flask-cors | 3.0.9 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-25032\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2020-25032",
+              "name": "CVE-2020-25032",
+              "properties": {
+                "security-severity": "8.7"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2020-25032: Flask-Cors Directory Traversal vulnerability",
+                "text": "CVE-2020-25032: Flask-Cors Directory Traversal vulnerability"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2023-25577",
+                "PYSEC-2023-58",
+                "GHSA-xg9f-g7g7-2323"
+              ],
+              "fullDescription": {
+                "markdown": "Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage.\n\nThis allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.",
+                "text": "Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage.\n\nThis allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2023-25577](https://osv.dev/CVE-2023-25577)**\n(Also published as: [PYSEC-2023-58](https://osv.dev/PYSEC-2023-58), [GHSA-xg9f-g7g7-2323](https://osv.dev/GHSA-xg9f-g7g7-2323), ).\n\n## [PYSEC-2023-58](https://osv.dev/PYSEC-2023-58)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.\n\n\u003c/details\u003e\n\n## [GHSA-xg9f-g7g7-2323](https://osv.dev/GHSA-xg9f-g7g7-2323)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage.\n\u003e \n\u003e This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-xg9f-g7g7-2323 | werkzeug | 2.2.3 |\n| PYSEC-2023-58 | werkzeug | 2.2.3, 517cac5a804e8c4dc4ed038bb20dacd038e7a9f1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-25577\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2023-25577](https://osv.dev/CVE-2023-25577)**\n(Also published as: [PYSEC-2023-58](https://osv.dev/PYSEC-2023-58), [GHSA-xg9f-g7g7-2323](https://osv.dev/GHSA-xg9f-g7g7-2323), ).\n\n## [PYSEC-2023-58](https://osv.dev/PYSEC-2023-58)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.\n\n\u003c/details\u003e\n\n## [GHSA-xg9f-g7g7-2323](https://osv.dev/GHSA-xg9f-g7g7-2323)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage.\n\u003e \n\u003e This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-xg9f-g7g7-2323 | werkzeug | 2.2.3 |\n| PYSEC-2023-58 | werkzeug | 2.2.3, 517cac5a804e8c4dc4ed038bb20dacd038e7a9f1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-25577\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2023-25577",
+              "name": "CVE-2023-25577",
+              "properties": {
+                "security-severity": "7.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2023-25577: High resource usage when parsing multipart form data with many fields",
+                "text": "CVE-2023-25577: High resource usage when parsing multipart form data with many fields"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2022-29361",
+                "PYSEC-2022-203"
+              ],
+              "fullDescription": {
+                "markdown": "",
+                "text": ""
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2022-29361](https://osv.dev/CVE-2022-29361)**.\n\n## [PYSEC-2022-203](https://osv.dev/PYSEC-2022-203)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| PYSEC-2022-203 | werkzeug | 2.1.1, 9a3a981d70d2e9ec3344b5192f86fcaf3210cd85 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2022-29361\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2022-29361](https://osv.dev/CVE-2022-29361)**.\n\n## [PYSEC-2022-203](https://osv.dev/PYSEC-2022-203)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| lockfile:/Users/john.doe/projects/python/poetry/poetry.lock | werkzeug | 0.16.1 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| PYSEC-2022-203 | werkzeug | 2.1.1, 9a3a981d70d2e9ec3344b5192f86fcaf3210cd85 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/Users/john.doe/projects/python/poetry/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2022-29361\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2022-29361",
+              "name": "CVE-2022-29361",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2022-29361",
+                "text": "CVE-2022-29361"
+              }
+            }
+          ],
+          "supportedTaxonomies": [],
+          "taxa": [],
+          "version": "2.2.0"
+        },
+        "extensions": []
+      },
+      "translations": [],
+      "versionControlProvenance": [],
+      "webRequests": [],
+      "webResponses": []
+    }
+  ],
+  "properties": {}
+}