# SBOM for polyglot-piranha 0.4.9 > Polyglot Piranha is a library for performing structural find and replace with deep cleanup. The Python package polyglot-piranha 0.4.9 ships 12 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/polyglot-piranha@0.4.9` - PyPI: https://pypi.org/project/polyglot-piranha/0.4.9/ - Author: Uber Technologies Inc. - Requires Python: \>=3.8 - documentation: - homepage: - repository: ## SBOMs ### polyglot\_piranha-0.4.9-cp310-cp310-macosx\_10\_13\_universal2.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/975d165e-daf1-51bc-b7ca-718806f410e5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp310-cp310-manylinux\_2\_28\_aarch64.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/da23df0d-ee0a-5bf2-88f2-07d79bba26cc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp310-cp310-manylinux\_2\_28\_x86\_64.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/cee942b0-80f4-5027-8de7-58ee6e3495a9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp311-cp311-macosx\_10\_13\_universal2.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/fee49def-2daa-503e-aca8-9c8b8fc5c469/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp311-cp311-manylinux\_2\_28\_aarch64.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/949509db-4a05-5f2f-b483-39de90003baa/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp311-cp311-manylinux\_2\_28\_x86\_64.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/559e6481-0827-5eb4-b06c-915e7871eaea/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp312-cp312-macosx\_10\_13\_universal2.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/ab9aa30c-8d3d-55e6-960b-15fbc672243d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp312-cp312-manylinux\_2\_28\_aarch64.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/3a60bf8f-41e6-5992-844d-cbec78649417/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp312-cp312-manylinux\_2\_28\_x86\_64.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/7f0bd955-ae5f-565e-8c6f-96f677a757d3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp39-cp39-macosx\_10\_13\_universal2.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/35018619-b680-5a85-82d9-a3cd49d5e198/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp39-cp39-manylinux\_2\_28\_aarch64.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/ac69e842-2c4d-527b-aa45-e416ec2f3ec9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### polyglot\_piranha-0.4.9-cp39-cp39-manylinux\_2\_28\_x86\_64.whl - [polyglot\_piranha-0.4.9.dist-info/sboms/piranha.cyclonedx.json](https://pypi.sbomify.com/artifact/c39f2080-0124-5c04-bf2d-00f3bdb92b23/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.20.3 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.20.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.20.3 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` | | [RUSTSEC-2022-0081](https://osv.dev/vulnerability/RUSTSEC-2022-0081) | unknown | json 0.12.4 (crates.io) | none listed | json is unmaintained | | [RUSTSEC-2023-0018](https://osv.dev/vulnerability/RUSTSEC-2023-0018) | unknown | remove\_dir\_all 0.5.3 (crates.io) | 0.8.0 | Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) | | [RUSTSEC-2018-0017](https://osv.dev/vulnerability/RUSTSEC-2018-0017) | unknown | tempdir 0.3.7 (crates.io) | none listed | \`tempdir\` crate has been deprecated; use \`tempfile\` instead | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/polyglot-piranha@0.4.9 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/polyglot-piranha/0.4.9.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/polyglot-piranha/0.4.9