← All credits

Stan Ulbrych (https://github.com/StanFromIreland)

13 vulnerability records and advisories credit this contributor.

CVE-2026-114583

tar filter allows writing outside destination via empty-named symlink

CVE-2026-116566

socket.getaddrinfo() accepts embedded null bytes in host and port

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

tarfile hardlink fallback ignores custom extraction filter rejection via None

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

tarfile extraction filter bypass allows creation of directories outside the destination

tarfile extraction filter bypass allows escaping the destination directory

tarfile opened in streaming mode mishandles EOF