spotipy vulnerabilities

2 known vulnerabilities in spotipy from Spotipy-dev. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  spotipy: Exposure of Data Element to Wrong Session

  CVE-2025-47928May 15, 2025Spotipy-dev

  Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by at

• 9.8 Critical severity

  spotipy: Incorrect Default Permissions

  CVE-2025-27154Feb 27, 2025Spotipy-dev

  Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-