Mechanicalsoup
Approved changes feed: RSS · Atom
cpe:2.3:a:mechanicalsoup_project:mechanicalsoup:*:*:*:*:*:python:*:*part: a version: * update: *
| Vendor | Mechanicalsoup Project (34250d5b-c81e-553a-8d4f-6c7a4e9f0423) |
|---|---|
| Product | Mechanicalsoup (0df0f1e7-53f3-54df-95c1-6ff2b2abc8d5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | python |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/mechanicalsoup/mechanicalsoup |
purl2cpe | 2026-06-01 10:17:17.914963 |
pkg:pypi/mechanicalsoup |
purl2cpe | 2026-06-01 10:17:17.914965 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-34457 |
vulnerable | 2026-06-08 06:06:25.637230 |
MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form
MEDIUM (5.9)
MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.
Published: 2023-07-05T19:25:35.966Z
Updated: 2025-02-13T16:55:35.658Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.