# SBOM for pywebnn 0.5.12

> Python bindings for W3C WebNN specification

The Python package pywebnn 0.5.12 ships 3 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/pywebnn@0.5.12`
- PyPI: https://pypi.org/project/pywebnn/0.5.12/
- License: Apache-2.0
- Requires Python: \>=3.10
- Documentation: <https://github.com/rustnn/pywebnn#readme>
- Homepage: <https://github.com/rustnn/pywebnn>
- Issues: <https://github.com/rustnn/pywebnn/issues>
- Repository: <https://github.com/rustnn/pywebnn>

## SBOMs

### pywebnn-0.5.12-cp312-cp312-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, rustnn/pywebnn, workflow publish.yml).

- [pywebnn-0.5.12.dist-info/sboms/pywebnn.cyclonedx.json](https://pypi.sbomify.com/artifact/c396c1f1-84c7-5f36-8792-55a59da04832/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities

### pywebnn-0.5.12-cp312-cp312-manylinux\_2\_34\_x86\_64.whl

PEP 740 attestation verified (GitHub, rustnn/pywebnn, workflow publish.yml).

- [pywebnn-0.5.12.dist-info/sboms/pywebnn.cyclonedx.json](https://pypi.sbomify.com/artifact/03047e57-b15e-503c-8fa1-41f03820933c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities

### pywebnn-0.5.12-cp312-cp312-win\_amd64.whl

PEP 740 attestation verified (GitHub, rustnn/pywebnn, workflow publish.yml).

- [pywebnn-0.5.12.dist-info/sboms/pywebnn.cyclonedx.json](https://pypi.sbomify.com/artifact/39e15994-6860-5b02-a346-b20e458c9fcd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.3 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.79 (crates.io) | 0.10.80 | rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers |
| [GHSA-7gcf-g7xr-8hxj](https://osv.dev/vulnerability/GHSA-7gcf-g7xr-8hxj) | medium (5.1) | serde\_with 3.19.0 (crates.io) | 3.21.0 | serde\_with: KeyValueMap serialization panics on empty sequence or map entries |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-root-certs 1.0.7 (crates.io) | 1.0.10 | Bundled root certificates allow trust in distrusted emSign intermediates |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/pywebnn@0.5.12
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/pywebnn/0.5.12.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/pywebnn/0.5.12