GHSA-gc5v-m9x4-r6x2

Suggest an improvement
Source
https://github.com/advisories/GHSA-gc5v-m9x4-r6x2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-gc5v-m9x4-r6x2/GHSA-gc5v-m9x4-r6x2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gc5v-m9x4-r6x2
Aliases
  • CVE-2026-25645
Related
Published
2026-03-25T16:56:28Z
Modified
2026-03-26T06:29:19.982144Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
Details

Impact

The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.

Affected usages

Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted.

Remediation

Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.

If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T16:56:28Z",
    "cwe_ids": [
        "CWE-377"
    ],
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

PyPI / requests

Package

Name
requests
View open source insights on deps.dev
Purl
pkg:pypi/requests

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.33.0

Affected versions

0.*
0.0.1
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.1
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.2
0.9.3
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.6
0.10.7
0.10.8
0.11.1
0.11.2
0.12.0
0.12.01
0.12.1
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.13.6
0.13.7
0.13.8
0.13.9
0.14.0
0.14.1
0.14.2
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.7.0
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2
2.10.0
2.11.0
2.11.1
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.14.0
2.14.1
2.14.2
2.15.0
2.15.1
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.17.0
2.17.1
2.17.2
2.17.3
2.18.0
2.18.1
2.18.2
2.18.3
2.18.4
2.19.0
2.19.1
2.20.0
2.20.1
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.25.1
2.26.0
2.27.0
2.27.1
2.28.0
2.28.1
2.28.2
2.29.0
2.30.0
2.31.0
2.32.0
2.32.1
2.32.2
2.32.3
2.32.4
2.32.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-gc5v-m9x4-r6x2/GHSA-gc5v-m9x4-r6x2.json"