SBOM for sbomify-action 26.11.0
Generate, augment, enrich, and manage SBOMs in your CI/CD pipeline
Package information
Available SBOMs
Read from .dist-info/sboms/ in each wheel.
sbomify_action-26.11.0-py3-none-any.whl
Attested
Valid
Download
sbomify-action.cdx.json
CycloneDX/1.6
application/vnd.cyclonedx+json
13 known vulnerabilities
Known vulnerabilities
Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in |
|---|---|---|---|
|
CVE-2026-112940
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
|
High 7.1 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-115586
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
|
High 7.1 | virtualenv 21.14.12 PyPI |
21.14.13 |
|
CVE-2026-112911
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
|
Medium 6.3 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112909
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
|
Medium 6.1 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112936
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
|
Medium 6.1 | filelock 3.30.0 PyPI |
4.0.9 |
|
CVE-2026-112938
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
|
Medium 5.8 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112915
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
|
Medium 5.5 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112908
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
|
Medium 5.3 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112910
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
|
Medium 5.3 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112935
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
|
Medium 4.7 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112939
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
|
Medium 4.7 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112913
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
|
Low 3.3 | filelock 3.30.0 PyPI |
4.2.1 |
|
CVE-2026-112907
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
|
Low 2.5 | filelock 3.30.0 PyPI |
4.2.1 |
Access via TEA
Use the Transparency Exchange API to fetch this SBOM programmatically:
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]