# SBOM for actfast 1.3.0 The Python package actfast 1.3.0 ships 26 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/actfast@1.3.0` - PyPI: https://pypi.org/project/actfast/1.3.0/ - Requires Python: \>=3.10 ## SBOMs ### actfast-1.3.0-cp310-abi3-macosx\_10\_12\_x86\_64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/3b357b2e-d6f3-5049-8f36-638816d4e726/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-macosx\_11\_0\_arm64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/b08d51e9-4abb-5b3b-920f-e9c5aad42d8b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/1e1421e6-b7bd-56b0-9c55-3c7370af2354/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/15111210-d367-52c5-8d5f-215b29df5c11/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/d5505666-09b3-5232-abad-9b11923772b9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/62c9357a-31ab-5c58-8f95-80650f61bea8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/a72ec2bb-0084-59bc-85a1-b617b5bd7977/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-manylinux\_2\_5\_i686.manylinux1\_i686.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/71379691-25e6-52a1-95ff-86a1fbe77b69/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-musllinux\_1\_2\_aarch64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/10582923-9802-5cb0-bde7-5fca69304995/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-musllinux\_1\_2\_armv7l.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/c7f6bd66-1eee-5965-9142-12628f1b990e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-musllinux\_1\_2\_i686.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/3c88330d-04a3-5052-9032-821eb2ed975d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-musllinux\_1\_2\_x86\_64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/ebacfdd4-4efd-591a-9c96-0a23f5b69ffb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-win32.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/3d4ff87a-a08c-57e6-89ae-5c16636f63c6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp310-abi3-win\_amd64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/6cc3d5a0-e63e-592f-84aa-0742677298dd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-macosx\_10\_12\_x86\_64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/969a9d4d-452e-5db0-8434-a76487f615c0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-macosx\_11\_0\_arm64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/404da83f-6644-562a-bebd-1c659c35b721/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/8ff7934b-7dd4-5232-8bdf-f74257e44ae4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/b8db7550-ddf4-5118-9b9d-b0e305a2fd56/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/afab8baf-e946-53c1-b5bc-140bc1428d94/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/333ac43b-22e5-54e0-8cc3-b62dbe1f5d7e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/64beede7-6edf-5ddc-831a-1a8553ff5e54/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-manylinux\_2\_5\_i686.manylinux1\_i686.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/32778586-5f9c-5bdb-82f9-26ec522318e6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-musllinux\_1\_2\_aarch64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/e4b06b3c-29fe-5f39-8c42-560bc7c46498/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-musllinux\_1\_2\_armv7l.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/b5fbdd38-566e-5e7d-a149-733b4ff5893c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-musllinux\_1\_2\_i686.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/ee76fb1c-401d-54e7-b8c3-1006a16ef2b4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### actfast-1.3.0-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl - [actfast-1.3.0.dist-info/sboms/actfast.cyclonedx.json](https://pypi.sbomify.com/artifact/39ca1dfb-fefe-5ad7-a97f-0203fef946f0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-115905](https://insights.sbomify.com/CVE-2026-115905/) | critical (10.0) | zip 8.6.0 (crates.io) | 9.0.5 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | | [RUSTSEC-2026-0369](https://osv.dev/vulnerability/RUSTSEC-2026-0369) | critical (9.1) | zip 8.6.0 (crates.io) | 9.0.0 | ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target | | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.3 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [CVE-2026-115907](https://insights.sbomify.com/CVE-2026-115907/) | high (7.5) | zip 8.6.0 (crates.io) | 9.0.0 | zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size | | [CVE-2026-115909](https://insights.sbomify.com/CVE-2026-115909/) | high (7.5) | zip 8.6.0 (crates.io) | 9.0.0 | zip: \`ZipArchive::extract\` aborts the process on a symlink entry with a large declared size | | [CVE-2026-115908](https://insights.sbomify.com/CVE-2026-115908/) | high (7.4) | zip 8.6.0 (crates.io) | 9.0.0 | zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. | | [RUSTSEC-2026-0367](https://osv.dev/vulnerability/RUSTSEC-2026-0367) | high (7.3) | zip 8.6.0 (crates.io) | 9.0.0 | Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation | | [CVE-2026-115906](https://insights.sbomify.com/CVE-2026-115906/) | medium (6.5) | zip 8.6.0 (crates.io) | 9.0.0 | zip: AES Entry HMAC Authentication Bypass on Premature EOF | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [RUSTSEC-2026-0368](https://osv.dev/vulnerability/RUSTSEC-2026-0368) | unknown | zip 8.6.0 (crates.io) | 9.0.0 | zip: \`ZipArchive::extract\` creates symbolic links whose attacker-controlled targets are outside the destination directory | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/actfast@1.3.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/actfast/1.3.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/actfast/1.3.0