Skip to content

SBOM for rmskin-builder 2.0.4

A script that will attempt to assemble a validating Rainmeter skin package for quick and easy distribution on Github.

CycloneDX PEP 740 attested 10 known vulnerabilities

Requires Python: >=3.9
PyPI: rmskin-builder 2.0.4
source: https://github.com/2bndy5/rmskin-action
tracker: https://github.com/2bndy5/rmskin-action/issues

Available SBOMs

Read from .dist-info/sboms/ in each wheel.

rmskin_builder-2.0.4-cp39-abi3-macosx_10_12_x86_64.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-macosx_11_0_arm64.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-manylinux_2_17_s390x.manylinux2014_s390x.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-win32.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-cp39-abi3-win_amd64.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-pp311-pypy311_pp73-manylinux_2_17_i686.manylinux2014_i686.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

rmskin_builder-2.0.4-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Attested

Publisher: GitHub Source: 2bndy5/rmskin-action Workflow: python.yml

rmskin-builder.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

Known vulnerabilities

Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.

Vulnerability	Severity	Component	Fixed in
CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE	Critical 10.0	zip 8.4.0 crates.io	9.0.5
RUSTSEC-2026-0369 ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target	Critical 9.1	zip 8.4.0 crates.io	9.0.0
RUSTSEC-2026-0176 Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators	High 8.7	pyo3 0.28.2 crates.io	0.29.0
CVE-2026-115907 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size	High 7.5	zip 8.4.0 crates.io	9.0.0
CVE-2026-115909 zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size	High 7.5	zip 8.4.0 crates.io	9.0.0
CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.	High 7.4	zip 8.4.0 crates.io	9.0.0
RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation	High 7.3	zip 8.4.0 crates.io	9.0.0
CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF	Medium 6.5	zip 8.4.0 crates.io	9.0.0
RUSTSEC-2026-0177 Missing `Sync` bound on `PyCFunction::new_closure` closures	Medium 6.3	pyo3 0.28.2 crates.io	0.29.0
RUSTSEC-2026-0368 zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory	Unknown	zip 8.4.0 crates.io	9.0.0

Access via TEA

Use the Transparency Exchange API to fetch this SBOM programmatically:

pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]