Skip to content

Conversation

@jackseceng
Copy link
Owner

Update form width on main page to 400px

Update form width on main page to 400px
@snyk-io
Copy link
Contributor

snyk-io bot commented Oct 8, 2025

🎉 Snyk checks have passed. No issues have been found so far.

security/snyk check is complete. No issues have been found. (View Details)

code/snyk check is complete. No issues have been found. (View Details)

@jackseceng jackseceng closed this Oct 8, 2025
@github-actions
Copy link

github-actions bot commented Oct 8, 2025

🔍 Vulnerabilities of jackseceng/linkshort:334

📦 Image Reference jackseceng/linkshort:334
digestsha256:bf4338e236e538be90243ecbd4e2bc1d4a2a54f0432351b7dfaa6b5113ee049b
vulnerabilitiescritical: 0 high: 0 medium: 1 low: 0
platformlinux/amd64
size41 MB
packages33
critical: 0 high: 0 medium: 1 low: 0 pip 25.2 (pypi)

pkg:pypi/[email protected]

medium 5.9: CVE--2025--8869 Improper Link Resolution Before File Access ('Link Following')

Affected range<=25.2
Fixed versionNot Fixed
CVSS Score5.9
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score0.055%
EPSS Percentile17th percentile
Description

Summary

In the fallback extraction path for source distributions, pip used Python’s tarfile module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during pip install.

Impact

Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running pip. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system.

Conditions

The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running pip install; active user action is necessary.

Remediation

The fix, while available as a patch that can be manually applied, has not yet been put into a numbered version but is planned for 25.3. Using a Python interpreter that implements the safe-extraction behavior described by PEP 706 provides additional defense in depth for other tarfile issues but is not a substitute for upgrading pip for this specific flaw.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants