opensearch-project / opensearch-project/sql-cli
pygments-2.19.2-py3-none-any.whl: 1 vulnerabilities (highest severity is: 3.3)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 9
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Description
Vulnerable Library - pygments-2.19.2-py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/sql-cli
Path to vulnerable library: /tmp/ws-ua_20260518195424_ZCYUWM/python_XKNQIE/202605181954251/env/lib/python3.12/site-packages/pygments-2.19.2.dist-info
Found in HEAD commit: 68212e0c681da02608aa39ca6a7234d5a082124e
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (pygments version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2026-4539 |  Low |
3.3 | pygments-2.19.2-py3-none-any.whl | Direct | pygments - 2.20.0 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-4539
Vulnerable Library - pygments-2.19.2-py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/sql-cli
Path to vulnerable library: /tmp/ws-ua_20260518195424_ZCYUWM/python_XKNQIE/202605181954251/env/lib/python3.12/site-packages/pygments-2.19.2.dist-info
Dependency Hierarchy:
- ❌ pygments-2.19.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 68212e0c681da02608aa39ca6a7234d5a082124e
Found in base branch: main
Vulnerability Details
A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Publish Date: 2026-03-22
URL: CVE-2026-4539
CVSS 3 Score Details (3.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-5239-wwwm-4pmq
Release Date: 2026-03-22
Fix Resolution: pygments - 2.20.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the dependency configuration in the sql-cli repository that brings in pygments 2.19.2. Upgrade it to pygments 2.20.0, then run the project's available checks and confirm that CVE-2026-4539 is no longer reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100