[Cycode] Fix for vulnerable manifest file dependency - requests updated to version 2.32.0#152
Conversation
…ed to version 2.32.0
![cycode-security-eu[bot]](https://avatars.githubusercontent.com/in/242055?s=60&v=4){kind=small}
| pytz==2020.4 # via flask-restx | ||
| redis==3.5.2 # via -r requirements.in | ||
| requests==2.23.0 # via -r requirements.in | ||
| requests==2.32.0 # via -r requirements.in |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | PyPI |
| Dependency | requests |
| Dependency Paths | requests 2.32.0 |
| Direct Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-gc5v-m9x4-r6x2 | CVE-2026-25645 | MEDIUM | 2.33.0 |
| GHSA-9hjg-9r4m-mvj7 | CVE-2024-47081 | MEDIUM | 2.32.4 |
Highest fixed version: 2.33.0
Description
Detects when new vulnerabilities affect your dependencies.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_everywhere <reason> | Applies to this manifest for this package for all requests in your repository |
| #cycode_ignore_manifest_here <reason> | Applies to this manifest in this request only |
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| #cycode_vulnerable_package_fix_this_violation | Fix this violation via a commit to this branch |
![cycode-security[bot]](https://avatars.githubusercontent.com/in/39308?s=60&v=4){kind=small}
| pytz==2020.4 # via flask-restx | ||
| redis==3.5.2 # via -r requirements.in | ||
| requests==2.23.0 # via -r requirements.in | ||
| requests==2.32.0 # via -r requirements.in |
There was a problem hiding this comment.
❗Cycode: Security vulnerability found in newly introduced dependency.
| Severity | Medium |
| Issue | Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function: CVE-2026-25645 |
| Ecosystem | PyPI |
| Dependency | requests |
| Dependency Paths | requests 2.32.0 |
| Direct Dependency | Yes |
| Upgrade | 2.33.0 |
Impact
The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.
Affected usages
Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted.
Remediation
Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.
If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.
Description
Detects when new vulnerabilities affect your dependencies.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_manifest_here <reason> | Applies to this manifest in this request only |
| #cycode_ignore_package_everywhere <reason> | Applies to this manifest for this package for all requests in your repository |
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| #cycode_vulnerable_package_fix_this_violation | Fix this violation via a commit to this branch |
| pytz==2020.4 # via flask-restx | ||
| redis==3.5.2 # via -r requirements.in | ||
| requests==2.23.0 # via -r requirements.in | ||
| requests==2.32.0 # via -r requirements.in |
There was a problem hiding this comment.
❗Cycode: Security vulnerability found in newly introduced dependency.
| Severity | Medium |
| Issue | Requests vulnerable to .netrc credentials leak via malicious URLs: CVE-2024-47081 |
| Ecosystem | PyPI |
| Dependency | requests |
| Dependency Paths | requests 2.32.0 |
| Direct Dependency | Yes |
| Upgrade | 2.32.4 |
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds
For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).
References
psf/requests#6965
https://seclists.org/fulldisclosure/2025/Jun/2
Description
Detects when new vulnerabilities affect your dependencies.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_manifest_here <reason> | Applies to this manifest in this request only |
| #cycode_ignore_package_everywhere <reason> | Applies to this manifest for this package for all requests in your repository |
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| #cycode_vulnerable_package_fix_this_violation | Fix this violation via a commit to this branch |
Cycode Vulnerable Dependencies Update
This pull request updates the following manifest file:
ctfd/data/CTFd/requirements.txt📂 ctfd/data/CTFd/requirements.txt
1 package will be updated to resolve vulnerabilities:
requests