GHSA-rrh3-cwwj-g5mg

Suggest an improvement
Source
https://github.com/advisories/GHSA-rrh3-cwwj-g5mg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rrh3-cwwj-g5mg
Aliases
Published
2026-07-15T15:33:06Z
Modified
2026-11-09T22:00:07Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Cornac: Path Traversal via _extract_archive() in download.py
Details

Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-09T21:46:35Z",
    "nvd_published_at": "2026-07-15T14:18:10Z",
    "severity": "HIGH"
}
References

Affected packages

PyPI / cornac

Package

Name
cornac
View open source insights on deps.dev
Purl
pkg:pypi/cornac

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.0

Affected versions

0.*
0.1.0
0.1.0.post1
0.1.0.post2
0.1.0.post3
0.1.0.post4
0.1.0.post5
0.2.0
0.2.1
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.3.0
1.3.1
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.6.1
1.7.0
1.7.1
1.8.0
1.9.0
1.10.0
1.11.0
1.12.0
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.14.0
1.14.1
1.14.2
1.15.0
1.15.1
1.15.2
1.15.3
1.15.4
1.16.0
1.17.0
1.18.0
2.*
2.0.0
2.1.0
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.5.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json"