Vulnerability advisory

PYSEC-2026-2275

Published Mar 25, 2026Updated Jul 13, 2026OSV record ↗

Also known as CVE-2026-25645GHSA-gc5v-m9x4-r6x2

Severity

CVSS 3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected versions

requests PyPI

All requests advisories →

Affected Fixed in

All versions before 2.33.0 2.33.0Advisories →

Affected	Fixed in
All versions before 2.33.0	`2.33.0`Advisories →
Also listed as affected (157) `0.0.1` `0.10.0` `0.10.1` `0.10.2` `0.10.3` `0.10.4` `0.10.6` `0.10.7` `0.10.8` `0.11.1` `0.11.2` `0.12.0` `0.12.01` `0.12.1` `0.13.0` `0.13.1` `0.13.2` `0.13.3` `0.13.4` `0.13.5` `0.13.6` `0.13.7` `0.13.8` `0.13.9` `0.14.0` `0.14.1` `0.14.2` `0.2.0` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.3.0` `0.3.1` `0.3.2` `0.3.3` `0.3.4` `0.4.0` `0.4.1` `0.5.0` `0.5.1` `0.6.0` `0.6.1` `0.6.2` `0.6.3` `0.6.4` `0.6.5` `0.6.6` `0.7.0` `0.7.1` `0.7.2` `0.7.3` `0.7.4` `0.7.5` `0.7.6` `0.8.0` `0.8.1` `0.8.2` `0.8.3` `0.8.4` `0.8.5` `0.8.6` `0.8.7` `0.8.8` `0.8.9` `0.9.0` `0.9.1` `0.9.2` `0.9.3` `1.0.0` `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1.0` `1.2.0` `1.2.1` `1.2.2` `1.2.3` `2.0.0` `2.0.1` `2.1.0` `2.10.0` `2.11.0` `2.11.1` `2.12.0` `2.12.1` `2.12.2` `2.12.3` `2.12.4` `2.12.5` `2.13.0` `2.14.0` `2.14.1` `2.14.2` `2.15.0` `2.15.1` `2.16.0` `2.16.1` `2.16.2` `2.16.3` `2.16.4` `2.16.5` `2.17.0` `2.17.1` `2.17.2` `2.17.3` `2.18.0` `2.18.1` `2.18.2` `2.18.3` `2.18.4` `2.19.0` `2.19.1` `2.2.0` `2.2.1` `2.20.0` `2.20.1` `2.21.0` `2.22.0` `2.23.0` `2.24.0` `2.25.0` `2.25.1` `2.26.0` `2.27.0` `2.27.1` `2.28.0` `2.28.1` `2.28.2` `2.29.0` `2.3.0` `2.30.0` `2.31.0` `2.32.0` `2.32.1` `2.32.2` `2.32.3` `2.32.4` `2.32.5` `2.4.0` `2.4.1` `2.4.2` `2.4.3` `2.5.0` `2.5.1` `2.5.2` `2.5.3` `2.6.0` `2.6.1` `2.6.2` `2.7.0` `2.8.0` `2.8.1` `2.9.0` `2.9.1` `2.9.2`

Also listed as affected (157)

0.0.1
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.6
0.10.7
0.10.8
0.11.1
0.11.2
0.12.0
0.12.01
0.12.1
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.13.6
0.13.7
0.13.8
0.13.9
0.14.0
0.14.1
0.14.2
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.1
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
2.0.0
2.0.1
2.1.0
2.10.0
2.11.0
2.11.1
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.14.0
2.14.1
2.14.2
2.15.0
2.15.1
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.17.0
2.17.1
2.17.2
2.17.3
2.18.0
2.18.1
2.18.2
2.18.3
2.18.4
2.19.0
2.19.1
2.2.0
2.2.1
2.20.0
2.20.1
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.25.1
2.26.0
2.27.0
2.27.1
2.28.0
2.28.1
2.28.2
2.29.0
2.3.0
2.30.0
2.31.0
2.32.0
2.32.1
2.32.2
2.32.3
2.32.4
2.32.5
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.7.0
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2

Description

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

PYSEC-2026-2275

Affected versions

requests PyPI

Description

References