PYSEC-2026-2059

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/yaql/PYSEC-2026-2059.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-2059

Aliases

Published

2026-07-07T11:45:35.519704Z

Modified

2026-07-07T17:48:18.058201333Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Information leakage in YAQL

Details

YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

References

Affected packages

PyPI / yaql

Package

Name: yaql; View open source insights on deps.dev
Purl: pkg:pypi/yaql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.0

Affected versions

0.*

0.2

0.2.1

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.2.7

0.3

1.*

1.0.0b1

1.0.0b2

1.0.0.0b3

1.0.0.0rc1

1.0.0.0rc2

1.0.0.0rc3

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.1.3

2.*

2.0.0

2.0.1

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/yaql/PYSEC-2026-2059.yaml"