opensearch-project / opensearch-project/sql-cli
requests-2.32.4-py3-none-any.whl: 1 vulnerabilities (highest severity is: 4.4)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 9
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Description
Vulnerable Library - requests-2.32.4-py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/7c/e4/56027c4a6b4ae70ca9de302488c5ca95ad4a39e190093d6c1a8ace08341b/requests-2.32.4-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/sql-cli
Path to vulnerable library: /tmp/ws-ua_20260518195424_ZCYUWM/python_XKNQIE/202605181954251/env/lib/python3.12/site-packages/requests-2.32.4.dist-info
Found in HEAD commit: 68212e0c681da02608aa39ca6a7234d5a082124e
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (requests version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2026-25645 |  Medium |
4.4 | requests-2.32.4-py3-none-any.whl | Direct | https://github.com/psf/requests.git - v2.33.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-25645
Vulnerable Library - requests-2.32.4-py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/7c/e4/56027c4a6b4ae70ca9de302488c5ca95ad4a39e190093d6c1a8ace08341b/requests-2.32.4-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/sql-cli
Path to vulnerable library: /tmp/ws-ua_20260518195424_ZCYUWM/python_XKNQIE/202605181954251/env/lib/python3.12/site-packages/requests-2.32.4.dist-info
Dependency Hierarchy:
- ❌ requests-2.32.4-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 68212e0c681da02608aa39ca6a7234d5a082124e
Found in base branch: main
Vulnerability Details
Requests is a HTTP library. Prior to version 2.33.0, the "requests.utils.extract_zipped_paths()" utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call "extract_zipped_paths()" directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set "TMPDIR" in their environment to a directory with restricted write access.
Publish Date: 2026-03-25
URL: CVE-2026-25645
CVSS 3 Score Details (4.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/psf/requests.git - v2.33.0
⛑️ Automatic Remediation will be attempted for this issue.
:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the dependency declaration in the sql-cli repository referenced by the scan path and confirm where requests 2.32.4 is pinned. Review the CVE-2026-25645 details and update the direct dependency to the fixed 2.33.0 release, then run the project's available tests or dependency scan to verify the vulnerable version is gone.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100