https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 15:18:40 +0000 https://vulnerability.circl.lu/vuln/cve-2025-50182 <p><strong>Affected:</strong> urllib3</p> <p>urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.</p> <p><strong>Affected:</strong> urllib3</p> <p>urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.</p> https://vulnerability.circl.lu/vuln/cve-2025-50182 https://vulnerability.circl.lu/vuln/ghsa-48p4-8xcf-vxj5 <p><strong>Affected:</strong> PyPI: urllib3</p> <p>urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.</p> <p>However, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.</p> <p>## Affected usages</p> <p>Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.</p> <p>## Remediation</p> <p>If you use urllib3 in Node.js, upgrade to a patched version of urllib3.</p> <p>Unfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.</p> <p><strong>Affected:</strong> PyPI: urllib3</p> <p>urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.</p> <p>However, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.</p> <p>## Affected usages</p> <p>Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.</p> <p>## Remediation</p> <p>If you use urllib3 in Node.js, upgrade to a patched version of urllib3.</p> <p>Unfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.</p> https://vulnerability.circl.lu/vuln/ghsa-48p4-8xcf-vxj5 https://vulnerability.circl.lu/vuln/pysec-2026-1997 <p><strong>Affected:</strong> PyPI: urllib3</p> <p>urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.</p> <p>However, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.</p> <p>## Affected usages</p> <p>Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.</p> <p>## Remediation</p> <p>If you use urllib3 in Node.js, upgrade to a patched version of urllib3.</p> <p>Unfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.</p> <p><strong>Affected:</strong> PyPI: urllib3</p> <p>urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.</p> <p>However, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.</p> <p>## Affected usages</p> <p>Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.</p> <p>## Remediation</p> <p>If you use urllib3 in Node.js, upgrade to a patched version of urllib3.</p> <p>Unfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.</p> https://vulnerability.circl.lu/vuln/pysec-2026-1997