# SBOM for sbomify-action 26.11.0 > Generate, augment, enrich, and manage SBOMs in your CI/CD pipeline The Python package sbomify-action 26.11.0 ships 1 SBOM file (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/sbomify-action@26.11.0` - PyPI: https://pypi.org/project/sbomify-action/26.11.0/ - License: Apache-2.0 - Requires Python: \>=3.11 - Bug Tracker: - Changelog: - Documentation: - Homepage: - Repository: ## SBOMs ### sbomify\_action-26.11.0-py3-none-any.whl PEP 740 attestation verified (GitHub, sbomify/sbomify-action, workflow pypi.yaml). - [sbomify\_action-26.11.0.dist-info/sboms/sbomify-action.cdx.json](https://pypi.sbomify.com/artifact/0e6ccd41-0dd1-5321-8b49-9a451747ea37/download): CycloneDX/1.6, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-112940](https://insights.sbomify.com/CVE-2026-112940/) | high (7.1) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files | | [CVE-2026-115586](https://insights.sbomify.com/CVE-2026-115586/) | high (7.1) | virtualenv 21.14.12 (PyPI) | 21.14.13 | virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) | | [CVE-2026-112911](https://insights.sbomify.com/CVE-2026-112911/) | medium (6.3) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion | | [CVE-2026-112909](https://insights.sbomify.com/CVE-2026-112909/) | medium (6.1) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path | | [CVE-2026-112936](https://insights.sbomify.com/CVE-2026-112936/) | medium (6.1) | filelock 3.30.0 (PyPI) | 4.0.9 | filelock: ReadWriteLock follows a symlink at the lock path into SQLite | | [CVE-2026-112938](https://insights.sbomify.com/CVE-2026-112938/) | medium (5.8) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: StrictSoftFileLock follows a symbolic link swapped in at \.filelock and creates claim files in a directory another local user chooses | | [CVE-2026-112915](https://insights.sbomify.com/CVE-2026-112915/) | medium (5.5) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout | | [CVE-2026-112908](https://insights.sbomify.com/CVE-2026-112908/) | medium (5.3) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold | | [CVE-2026-112910](https://insights.sbomify.com/CVE-2026-112910/) | medium (5.3) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL | | [CVE-2026-112935](https://insights.sbomify.com/CVE-2026-112935/) | medium (4.7) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders | | [CVE-2026-112939](https://insights.sbomify.com/CVE-2026-112939/) | medium (4.7) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker | | [CVE-2026-112913](https://insights.sbomify.com/CVE-2026-112913/) | low (3.3) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database | | [CVE-2026-112907](https://insights.sbomify.com/CVE-2026-112907/) | low (2.5) | filelock 3.30.0 (PyPI) | 4.2.1 | filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/sbomify-action@26.11.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/sbomify-action/26.11.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/sbomify-action/26.11.0