Skip to content
OpenAdvisories

Package · PyPI

potato-annotation

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 5.1
    GHSA-q9m2-fhv9-3jcf

    `potato-annotation` has a Project-Boundary Bypass

    ## Summary `validate_path_security` uses string-prefix containment (`startswith`) for boundary checks. This allows paths that are **outside** the intended project directory but share its prefix string (e.g., `/tmp/potato_proj_demo_evil/...` vs `/tmp/potato_pr…

    potato-annotation PyPI