# SBOM for psd-tools 1.14.2

> Python package for working with Adobe Photoshop PSD files

The Python package psd-tools 1.14.2 ships 8 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/psd-tools@1.14.2`
- PyPI: https://pypi.org/project/psd-tools/1.14.2/
- Requires Python: \>=3.10

## SBOMs

### psd\_tools-1.14.2-cp310-cp310-musllinux\_1\_2\_aarch64.whl

- [psd\_tools-1.14.2.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/5fde9d5c-eac2-5b30-83fd-e53cc679be33/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### psd\_tools-1.14.2-cp310-cp310-musllinux\_1\_2\_x86\_64.whl

- [psd\_tools-1.14.2.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/eb583d4f-1d6e-5493-bd2b-16a929ea1fd2/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### psd\_tools-1.14.2-cp311-cp311-musllinux\_1\_2\_aarch64.whl

- [psd\_tools-1.14.2.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/858ee626-6da2-51ba-a5db-6fa895789473/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### psd\_tools-1.14.2-cp311-cp311-musllinux\_1\_2\_x86\_64.whl

- [psd\_tools-1.14.2.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/fa9073dc-b2a1-5dbc-bb44-f13777472b49/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### psd\_tools-1.14.2-cp312-cp312-musllinux\_1\_2\_aarch64.whl

- [psd\_tools-1.14.2.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e56f6608-7a4c-57c1-94d6-9482f09c3876/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### psd\_tools-1.14.2-cp312-cp312-musllinux\_1\_2\_x86\_64.whl

- [psd\_tools-1.14.2.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/d43ff109-f1f9-5582-b08e-a0a1f3af8854/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### psd\_tools-1.14.2-cp313-abi3-musllinux\_1\_2\_aarch64.whl

- [psd\_tools-1.14.2.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/cdb9d607-4b02-5514-bea4-061e0f07aa37/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### psd\_tools-1.14.2-cp313-abi3-musllinux\_1\_2\_x86\_64.whl

- [psd\_tools-1.14.2.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/62bf18dd-beea-570a-afd6-1984242cb388/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-59991](https://insights.sbomify.com/CVE-2026-59991/) | high (7.5) | psd-tools 1.14.2 (PyPI) | 1.17.4 | psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry |
| [CVE-2026-49836](https://insights.sbomify.com/CVE-2026-49836/) | medium (4.6) | psd-tools 1.14.2 (PyPI) | 1.17.1 | psd-tools vulnerable to arbitrary file write via smart-object filename |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/psd-tools@1.14.2
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/psd-tools/1.14.2.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/psd-tools/1.14.2