Pydantic Settings
Approved changes feed: RSS · Atom
cpe:2.3:a:pydantic:pydantic-settings:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pydantic (6f5de00e-79d0-582d-accc-2e89c5d865ef) |
|---|---|
| Product | Pydantic Settings (76221a4c-aeb3-5aa5-b6aa-51e0cd363030) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pydantic/pydantic-settings |
purl2cpe | 2026-07-28 16:40:56.910805 |
pkg:pypi/pydantic-settings |
purl2cpe | 2026-07-28 16:40:56.910807 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-58203 |
vulnerable | 2026-07-29 01:03:16.687980 |
NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
MEDIUM (5.3)
pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a configured secrets_dir. When secrets_nested_subdir=True, a directory entry inside secrets_dir that is a symbolic link pointing outside secrets_dir is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented secrets_dir_max_size protection. An attacker or lower-privileged component able to influence entries in the configured secrets directory (for example, a writable or shared secrets mount) can turn this into an unintended local file read into settings and can defeat the advertised loading-size cap. This vulnerability is fixed in 2.14.2.
Published: 2026-07-06T14:24:15.740Z
Updated: 2026-07-06T16:19:59.090Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.