# SBOM for decasify 0.11.4

The Python package decasify 0.11.4 ships 1 SBOM file (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/decasify@0.11.4`
- PyPI: https://pypi.org/project/decasify/0.11.4/
- Requires Python: \>=3.8
- Homepage: <https://github.com/alerque/decasify>

## SBOMs

### decasify-0.11.4-cp314-cp314-manylinux\_2\_34\_x86\_64.whl

- [decasify-0.11.4.dist-info/sboms/decasify.cyclonedx.json](https://pypi.sbomify.com/artifact/32d95a5a-ef95-50ef-b377-69188ddd7229/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-82254](https://insights.sbomify.com/CVE-2026-82254/) | high (8.7) | gix-pack 0.64.1 (crates.io) | 0.69.0 | gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data |
| [CVE-2026-40034](https://insights.sbomify.com/CVE-2026-40034/) | high (8.5) | gix 0.77.0 (crates.io) | 0.83.0 | gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix\_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules |
| [CVE-2026-44471](https://insights.sbomify.com/CVE-2026-44471/) | high (7.8) | gix-fs 0.18.2 (crates.io) | 0.21.1 | gix-fs: Symlink prefix-reuse allows worktree escape during checkout |
| [CVE-2026-82251](https://insights.sbomify.com/CVE-2026-82251/) | high (7.7) | gix 0.77.0 (crates.io) | 0.83.0 | gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository |
| [CVE-2026-82252](https://insights.sbomify.com/CVE-2026-82252/) | high (7.7) | gix 0.77.0 (crates.io) | 0.83.0 | gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository |
| [CVE-2026-82253](https://insights.sbomify.com/CVE-2026-82253/) | high (7.5) | gix 0.77.0 (crates.io) | 0.83.0 | gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure |
| [CVE-2026-82253](https://insights.sbomify.com/CVE-2026-82253/) | high (7.5) | gix-validate 0.10.1 (crates.io) | 0.11.1 | gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure |
| [CVE-2025-24890](https://insights.sbomify.com/CVE-2025-24890/) | medium (6.8) | gix-sec 0.12.2 (crates.io) | 0.13.3 | gix-sec safe.directory protections absent for elevated administrators |
| [CVE-2026-82255](https://insights.sbomify.com/CVE-2026-82255/) | medium (6.8) | gix-transport 0.52.1 (crates.io) | 0.56.0 | gix-transport: HTTP credentials leaked to redirected host in curl backend |
| [CVE-2026-82250](https://insights.sbomify.com/CVE-2026-82250/) | medium (6.5) | gix-packetline 0.20.0 (crates.io) | 0.21.5 | gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS) |
| [RUSTSEC-2026-0306](https://osv.dev/vulnerability/RUSTSEC-2026-0306) | unknown | faster-hex 0.10.0 (crates.io) | 0.10.1 | \`hex\_decode\_unchecked\` AVX2 path reads past \`src\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/decasify@0.11.4
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/decasify/0.11.4.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/decasify/0.11.4