Description
An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | aliyundrive-webdav | <= 2.3.3 | — | GHSA-73v2-rxqp-7q4f |
| PyPI | aliyundrive-webdav | <= 2.3.3 | — | PYSEC-2026-1114 |