GitHub Advisoryadvisory · PyPI

GHSA-6wrm-x65g-hr4p OpenStack Horizon RC file generation does not escape special characters in project names

MEDIUM Published 2026-06-17 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-55748
Ecosystem
PyPI
Packages
horizon
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Weaknesses
CWE-78
Reviewed
2026-06-18

Affected packages

• PyPI horizon: <= 25.7.3 (no fix yet)

Description

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

Related

Alias · CVE (1)

  • CVE-2026-55748 OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References