GHSA-9hjg-9r4m-mvj7

Suggest an improvement
Source
https://github.com/advisories/GHSA-9hjg-9r4m-mvj7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9hjg-9r4m-mvj7/GHSA-9hjg-9r4m-mvj7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9hjg-9r4m-mvj7
Aliases
Related
Published
2025-06-09T19:06:08Z
Modified
2025-06-09T19:27:13.389930Z
Downstream
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Requests vulnerable to .netrc credentials leak via malicious URLs
Details

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2

Database specific 
{
    "nvd_published_at": "2025-06-09T18:15:24Z",
    "cwe_ids": [
        "CWE-522"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-09T19:06:08Z"
}
References

Affected packages

PyPI / requests

Package

Name
requests
View open source insights on deps.dev
Purl
pkg:pypi/requests

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.32.4

Affected versions

0.*

0.0.1
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.1
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.2
0.9.3
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.6
0.10.7
0.10.8
0.11.1
0.11.2
0.12.0
0.12.01
0.12.1
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.13.6
0.13.7
0.13.8
0.13.9
0.14.0
0.14.1
0.14.2

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3

2.*

2.0.0
2.0.1
2.1.0
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.7.0
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2
2.10.0
2.11.0
2.11.1
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.14.0
2.14.1
2.14.2
2.15.0
2.15.1
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.17.0
2.17.1
2.17.2
2.17.3
2.18.0
2.18.1
2.18.2
2.18.3
2.18.4
2.19.0
2.19.1
2.20.0
2.20.1
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.25.1
2.26.0
2.27.0
2.27.1
2.28.0
2.28.1
2.28.2
2.29.0
2.30.0
2.31.0
2.32.0
2.32.1
2.32.2
2.32.3