GHSA-gc5v-m9x4-r6x2 CVE-2026-25645 PYSEC-2026-2275
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
- Severity
- 4.4 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.19%
- Chance of exploitation in the next 30 days. Higher than 8.61% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-377 Insecure Temporary File
- Fix
2.33.0- Upgrade requests to this version or later
Description
Impact
The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.
Affected usages
Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted.
Remediation
Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.
If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
requests PyPI → 2.33.0
- pip
pip install --upgrade "requests>=2.33.0"- poetry
poetry add "requests>=2.33.0"- uv
uv add "requests>=2.33.0"
Severity breakdown
CVSS 3.1 4.4
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-377: Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9hjg-9r4m-mvj7 Requests vulnerable to .netrc credentials leak via malicious URLs | Medium | Also affects requests |
| GHSA-9wx4-h78v-vm56 Requests `Session` object does not verify requests after making first request with verify=False | Medium | Also affects requests |
| GHSA-j8r2-6x86-q33q Unintended leak of Proxy-Authorization header in requests | Medium | Also affects requests |
| GHSA-x84v-xcm2-53pg Insufficiently Protected Credentials in Requests | High | Also affects requests |
| GHSA-pg2w-x9wp-vw92 Python Requests Session Fixation | Medium | Also affects requests |
| GHSA-cfj3-7x9c-4p3h Exposure of Sensitive Information to an Unauthorized Actor in Requests | Medium | Also affects requests |
| GHSA-652x-xj99-gmcc Exposure of Sensitive Information to an Unauthorized Actor in Requests | Medium | Also affects requests |
| GHSA-4vp2-6q8c-pvq2 @anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write | Medium | Same weakness, CWE-377 |
Credits: Jaycelation, nateprewitt, sigmavirus24
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor