{"answers":{"affected":"2 open source packages ship an affected version, including taipy.","exploited":"There is no known exploitation of GHSA-pp84-v3mw-gg4w in the wild and no public exploit code.","fix":"Upgrade taipy to 4.0.0 or later.","what":"GHSA-pp84-v3mw-gg4w is a vulnerability in taipy, published on 27 Aug 2024. It can be exploited over the network."},"fix_prompt":"Check this codebase for GHSA-pp84-v3mw-gg4w and fix it if it is affected.\n\nWhat it is: GHSA-pp84-v3mw-gg4w is a vulnerability in taipy, published on 27 Aug 2024. It can be exploited over the network.\nExploitation: There is no known exploitation of GHSA-pp84-v3mw-gg4w in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- taipy (PyPI): affected all versions; fixed in 4.0.0\n- taipy (PyPI): affected all versions; fixed in 4.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-pp84-v3mw-gg4w/ (Markdown: https://insights.sbomify.com/GHSA-pp84-v3mw-gg4w/index.md)","id":"GHSA-pp84-v3mw-gg4w","markdown":"https://insights.sbomify.com/GHSA-pp84-v3mw-gg4w/index.md","name":"GHSA-pp84-v3mw-gg4w","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Python web framework","requires_auth":"unknown","summary":"Taipy library is vulnerable via outdated Flask and PyMongo dependencies, allowing potential code execution or data access; upgrade required.","user_interaction":"unknown","vuln_class":"supply_chain"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nIndirect CVEs affect Taipy 3.1.1\n\n### Details\nTaipy 3.1.1 is affected by two existing CVEs:\nCVE-2024-1681 affects flask-core \u003c4.0.1 and taipy 3.1.1 needs \u003c=4.0.0\nCVE-2024-5629 affects pymongo \u003c4.6.3 and taipy 3.1.1 needs \u003c=4.6.1\n\nPlease see References for further details.\n\n### Patch\nplease upgrade to the following versions:\n\nFixed on patch versions: \u003e=3.1.2\nand on major releases: \u003e=4.0.0\n\n### Impact\npre-commit breaks when using dependency Taipy 3.1.1","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Taipy 3.1.1 affected by CVEs on flask-core and pymongo","id":"GHSA-pp84-v3mw-gg4w","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"supply_chain","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["4.0.0"],"introduced":["0"],"last_affected":[],"package":"taipy","purl":null,"source":"GHSA-pp84-v3mw-gg4w"},{"ecosystem":"PyPI","fixed":["4.0.0"],"introduced":["0"],"last_affected":[],"package":"taipy","purl":"pkg:pypi/taipy","source":"GHSA-pp84-v3mw-gg4w"}],"products":null,"published":"2024-08-27","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Taipy library is vulnerable via outdated Flask and PyMongo dependencies, allowing potential code execution or data access; upgrade required.","url":"https://insights.sbomify.com/GHSA-pp84-v3mw-gg4w/"}