GitHub Advisoryadvisory · PyPI
GHSA-5qvp-pr9f-2g2v poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645
MEDIUM
Official page ↗
- Ecosystem
- PyPI
- Packages
- poetry-plugin-tweak-dependencies-version
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-377
- Reviewed
- 2026-04-01
Affected packages
• PyPI poetry-plugin-tweak-dependencies-version: < 1.5.6 → fixed in 1.5.6
Description
Pin vulnerable version of requests library
Related
Weakness · not in database (1)
References
- https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2 web
- https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/security/advisories/GHSA-5qvp-pr9f-2g2v web
- https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/commit/54b5784d89f36cd413a8bc5032ab0a96438dcae3 web
- https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version package
- https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/releases/tag/1.5.6 web