PYSEC-2025-8 After the owner removed the project from PyPI, another user uploaded a new version with non-working code
A malicious actor uploaded a non-functional package to PyPI under a previously removed name, causing potential denial of service for users installing it.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is PYSEC-2025-8?
PYSEC-2025-8 is a vulnerability in pygments-style-solarized, published on 17 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The pygments-style-solarized project was removed from PyPI by its owner on 2021-08-26.
The GitHub repository was also updated to show unmaintained, and archived on 2025-08-31.
Another user uploaded a new version, 100.10.7, which contains non-working code,
with clear language that it intends to be a dependency confusion attack.
It also does not contain working hacking code.
The name has been prohibited on from use on PyPI on 2021-12-12.
Which versions are affected by PYSEC-2025-8?
1 open source package ship an affected version, including pygments-style-solarized.
| Package | Affected | Fixed in |
|---|---|---|
pygments-style-solarized PyPI | All versions | None |
How do I fix PYSEC-2025-8?
No fix has been published for PYSEC-2025-8 yet. Limit exposure of the affected software until one is available.
Is PYSEC-2025-8 being exploited?
There is no known exploitation of PYSEC-2025-8 in the wild and no public exploit code.