CyberSecBulletin

Spotipy-dev vulnerabilities

We track 2 vulnerabilities in Spotipy-dev products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 15, 2025.

2vulnerabilities
2critical
0high
0exploited
9.4average CVSS score

Latest Spotipy-dev vulnerabilities

  • 9.1 Critical severity

    spotipy: Exposure of Data Element to Wrong Session

    CVE-2025-47928Spotipy-dev

    Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by at

  • 9.8 Critical severity

    spotipy: Incorrect Default Permissions

    CVE-2025-27154Spotipy-dev

    Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-