# SBOM for motrixsim 0.6.1 > A high-performance physics simulation engine designed for multibody dynamics and robotics simulation. The Python package motrixsim 0.6.1 ships 4 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/motrixsim@0.6.1` - PyPI: https://pypi.org/project/motrixsim/0.6.1/ - License: Apache-2.0 - Requires Python: \<3.14,\>=3.10 - documentation: - repository: ## SBOMs ### motrixsim-0.6.1-cp310-cp310-macosx\_11\_0\_arm64.whl - [motrixsim-0.6.1.dist-info/sboms/motrixsim-py.cyclonedx.json](https://pypi.sbomify.com/artifact/d27b5a55-afaf-5a36-9a7d-4922970196bb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 20 known vulnerabilities ### motrixsim-0.6.1-cp311-cp311-macosx\_11\_0\_arm64.whl - [motrixsim-0.6.1.dist-info/sboms/motrixsim-py.cyclonedx.json](https://pypi.sbomify.com/artifact/1549c280-21eb-5f2c-af45-eb2b99b81316/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 20 known vulnerabilities ### motrixsim-0.6.1-cp312-cp312-macosx\_11\_0\_arm64.whl - [motrixsim-0.6.1.dist-info/sboms/motrixsim-py.cyclonedx.json](https://pypi.sbomify.com/artifact/3a8461bc-d623-5101-ad31-01df50216916/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 20 known vulnerabilities ### motrixsim-0.6.1-cp313-cp313-macosx\_11\_0\_arm64.whl - [motrixsim-0.6.1.dist-info/sboms/motrixsim-py.cyclonedx.json](https://pypi.sbomify.com/artifact/ce0131bf-53c6-545d-84a8-f3e0b9bb94a9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 20 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.25.1 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.36.2 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names | | [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.38.4 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names | | [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.36.2 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service | | [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.38.4 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service | | [RUSTSEC-2026-0344](https://osv.dev/vulnerability/RUSTSEC-2026-0344) | high (7.5) | ruzstd 0.8.2 (crates.io) | 0.9.1 | Decompression bomb in \`ruzstd\`: a tiny input can exhaust memory (OOM) | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.25.1 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.101 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` | | [RUSTSEC-2026-0105](https://osv.dev/vulnerability/RUSTSEC-2026-0105) | unknown | core2 0.4.0 (crates.io) | none listed | core2 is unmaintained, all versions yanked | | [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid | | [RUSTSEC-2026-0221](https://osv.dev/vulnerability/RUSTSEC-2026-0221) | unknown | event-listener 5.4.1 (crates.io) | 5.4.2 | \`event-listener\` allows \`!Send\` tags to cross thread boundaries via \`StackSlot\` | | [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.9 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.9.2 (crates.io) | 0.9.3 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2026-0206](https://osv.dev/vulnerability/RUSTSEC-2026-0206) | unknown | rustybuzz 0.14.1 (crates.io) | none listed | \`rustybuzz\` is unmaintained | | [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.20.0 (crates.io) | none listed | \`ttf-parser\` is unmaintained | | [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.21.1 (crates.io) | none listed | \`ttf-parser\` is unmaintained | | [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.25.1 (crates.io) | none listed | \`ttf-parser\` is unmaintained | | [RUSTSEC-2026-0257](https://osv.dev/vulnerability/RUSTSEC-2026-0257) | unknown | webbrowser 1.1.0 (crates.io) | 1.2.2 | Unix \`BROWSER\` handling allows browser argument injection | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/motrixsim@0.6.1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/motrixsim/0.6.1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/motrixsim/0.6.1