Do now Upgrade Python StateMachine to 3.2.0 or later, or stop loading untrusted SCXML documents. Advisory
Health inspection
C
Python
6 criticals on the rail
Inspected live by pwned.coffee
What the inspector found
-
Python StateMachine Remote code execution -
LiteLLM Python package LiteLLM Supply Chain Attack Do now Check whether LiteLLM was installed and rotate any credentials it could access. Advisory -
Pillow Argument Injection in Ghostscript call, potentially leading into RCE Fixed in Pillow 13.0.0 Advisorypip install --upgrade "Pillow>=13.0.0" -
Pillow Multi-frame loaders can reuse stale native image storage after mode transitions Fixed in Pillow 13.0.0 Advisorypip install --upgrade "Pillow>=13.0.0" -
Pillow Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Fixed in Pillow 13.0.0 Advisorypip install --upgrade "Pillow>=13.0.0" -
Pillow Heap buffer overflow in ImagingJpegDecode Fixed in Pillow 13.0.0 Advisorypip install --upgrade "Pillow>=13.0.0"
How grades work
- FSomething is exploited and has no fix.
- DSomething is exploited, but a fix exists.
- CSomething has no fix yet, or three or more criticals are on the rail.
- BHigh or critical fixes are waiting to be carried.
- ANothing serious on the rail.
Put it on your README:
[](https://pwned.coffee/grade/python)