PT-2026-37196 · Pypi · Pyp2Spec

Gouldnicholas · Published 2026-05-04 · Updated 2026-05-11 · CVE-2026-42301

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyp2spec versions prior to 0.14.1

Description pyp2spec writes PyPI package metadata, such as the summary field, into generated spec files without escaping RPM macro directives. When a packager uses tools like rpmbuild -bs, rpmbuild --nobuild, or rpm -q --specfile, these directives are evaluated, allowing a malicious package to execute arbitrary commands on the build machine. This execution occurs during spec parsing, meaning a full build is not required for compromise. Potential attack vectors include typosquatting or targeting packages under Fedora review, which could lead to the compromise of sensitive credentials such as dist-git SSH keys, Koji build credentials, and Bodhi update credentials.

Recommendations Update to version 0.14.1.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

CVE-2026-42301

GHSA-R35X-V8P8-XVHW

Affected Products

Pyp2Spec

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-42301 · Security Note
• https://osv.dev/vulnerability/GHSA-r35x-v8p8-xvhw · Vendor Advisory
• https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw · Note
• https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1 · Note
• https://github.com/befeleme/pyp2spec · Note
• https://t.me/CVEtracker/53209 · Telegram Post
• https://twitter.com/CVEarity/status/2053794071484019083 · Twitter Post
• https://twitter.com/CVEnew/status/2053131386241052839 · Twitter Post