PT-2026-53626 · Pypi · Uni2Ts

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.

Fix

Related Identifiers

PYSEC-2026-557

Affected Products

Uni2Ts

References · 9

• https://osv.dev/vulnerability/PYSEC-2026-557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22584 · Security Note
• https://github.com/SalesforceAIResearch/uni2ts/commit/7f2d51dd729de018f0f22504f39a8475c6fed1c4 · Note
• https://github.com/SalesforceAIResearch/uni2ts · Note
• https://github.com/SalesforceAIResearch/uni2ts/releases/tag/2.0.0 · Note
• https://github.com/SalesforceAIResearch/uni2ts/pull/218 · Note
• https://github.com/advisories/GHSA-7x99-8x99-xc54 · Note
• https://pypi.org/project/uni2ts · Note
• https://help.salesforce.com/s/articleView?id=005239354&type=1 · Note