Omnigodz

**Name of the Vulnerable Software and Affected Versions** conda-forge-metadata (affected versions not specified) **Description** The issue concerns the use of an optional dependency called `conda-oci-mirror` by conda-forge-metadata, which provides programmatic access to conda-forge's metadata. This dependency was not present in the PyPi repository and was not registered by any entity. If `conda-oci-mirror` is taken over by a threat actor, it can result in remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python JSON Logger versions prior to 3.3.0 **Description** The issue is related to a missing dependency in the Python JSON Logger, which could allow a remote attacker to execute arbitrary code. This occurred because the `msgspec-python313-pre` package was deleted by its owner, leaving its name open to being claimed by a third party. If the package was claimed, it would allow the claimant remote code execution on any Python JSON Logger user who installed the development dependencies on Python 3.13. The estimated number of potentially affected devices is over 13 million. **Recommendations** Update to Python JSON Logger version 3.3.0 or later to resolve the issue. As a temporary workaround, consider avoiding the installation of development dependencies on Python 3.13 until the issue is resolved. Restrict access to the vulnerable `python-json-logger` package to minimize the risk of exploitation.