{"answers":{"affected":"2 open source packages ship an affected version, including nono-py.","exploited":"There is no known exploitation of GHSA-9j7f-3r4p-pwh6 in the wild and no public exploit code.","fix":"Upgrade nono-py to 0.11.0 or later.","what":"GHSA-9j7f-3r4p-pwh6 is an authentication bypass vulnerability in nono-py, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-9j7f-3r4p-pwh6 and fix it if it is affected.\n\nWhat it is: GHSA-9j7f-3r4p-pwh6 is an authentication bypass vulnerability in nono-py, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-9j7f-3r4p-pwh6 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- nono-py (PyPI): affected all versions; fixed in 0.11.0\n- nono-py (PyPI): affected all versions; fixed in 0.11.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-9j7f-3r4p-pwh6/ (Markdown: https://insights.sbomify.com/GHSA-9j7f-3r4p-pwh6/index.md)","id":"GHSA-9j7f-3r4p-pwh6","markdown":"https://insights.sbomify.com/GHSA-9j7f-3r4p-pwh6/index.md","name":"GHSA-9j7f-3r4p-pwh6","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Python sandboxing library","requires_auth":"none","summary":"A sandboxed child process can bypass route restrictions to access arbitrary network hosts via the local proxy, potentially leading to data exfiltration.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The python API made a restrictive-looking configuration unsafe by default. A caller could configure only reverse-\nproxy credential routes, put the child in CapabilitySet.proxy_only, and reasonably expect network access to be limited\nto those routes. Instead, because empty allowed_hosts meant allow-all inside nono-proxy, the child could use the local\nproxy as a transparent CONNECT tunnel to non-route nominated hosts (not including metadata endpoints).\n\nThat is an authorization bypass / policy confusion issue:\n\n- Intended policy: route-only proxy access.\n- Actual policy: route-only plus arbitrary transparent CONNECT.\n- Boundary crossed: sandboxed child gains broader outbound network reach than the Python policy appears to grant.\n- Impact depends on environment, but it can allow exfiltration or access to unintended internet/internal services\n  through the unsandboxed proxy.\n\nThis should be classified as medium severity by default, potentially high if users rely on route-only configs for strict egress\ncontrol around untrusted code or sensitive credentials. The fix is security-relevant because it changes the default from\nimplicit allow-all to explicit opt-in.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"nono-py vulnerable to authorization bypass / policy confusion","id":"GHSA-9j7f-3r4p-pwh6","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["0.11.0"],"introduced":["0"],"last_affected":[],"package":"nono-py","purl":null,"source":"GHSA-9j7f-3r4p-pwh6"},{"ecosystem":"PyPI","fixed":["0.11.0"],"introduced":["0"],"last_affected":[],"package":"nono-py","purl":"pkg:pypi/nono-py","source":"GHSA-9j7f-3r4p-pwh6"}],"products":null,"published":"2026-06-26","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A sandboxed child process can bypass route restrictions to access arbitrary network hosts via the local proxy, potentially leading to data exfiltration.","url":"https://insights.sbomify.com/GHSA-9j7f-3r4p-pwh6/"}