# SBOM for typst 0.15.2 > Python binding to Typst, a new markup-based typesetting system that is powerful and easy to learn. The Python package typst 0.15.2 ships 20 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/typst@0.15.2` - PyPI: https://pypi.org/project/typst/0.15.2/ - Requires Python: \>=3.9 - Documentation: - Homepage: - Readme: - Repository: ## SBOMs ### typst-0.15.2-cp314-cp314t-macosx\_10\_12\_x86\_64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/eae5053b-581b-5a05-bf5c-ab0a72f28836/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp314-cp314t-macosx\_11\_0\_arm64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/08aa50b2-e6f6-5028-9b65-7cd8076eff14/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp314-cp314t-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/bec0b476-f020-5ec0-9a06-70d341f2cc8c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp314-cp314t-manylinux2014\_armv7l.manylinux\_2\_17\_armv7l.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/cab4a8b7-264d-55b5-a36c-0ee940366918/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp314-cp314t-manylinux2014\_ppc64le.manylinux\_2\_17\_ppc64le.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/4d42f476-cfd6-5703-87ca-6aea6cf192dd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp314-cp314t-manylinux2014\_s390x.manylinux\_2\_17\_s390x.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/74258eee-3ddb-514f-bf21-994cc2b275bf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp314-cp314t-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/3d6cb719-8982-56f7-b993-277306bf09f3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp314-cp314t-win\_amd64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/070992c5-d349-5573-b0eb-76852ee194a4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-macosx\_10\_12\_x86\_64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/9d0660ef-477a-5713-a9d7-14cdf9f2de03/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-macosx\_11\_0\_arm64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/8c812f97-f83c-5086-b67b-be1f341ec934/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/ca87aa99-0ad0-54ec-8000-3b8a998563ac/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-manylinux2014\_armv7l.manylinux\_2\_17\_armv7l.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/792bcbd3-d200-514f-9703-40990c9be170/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-manylinux2014\_ppc64le.manylinux\_2\_17\_ppc64le.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/48027754-1e18-5345-9b20-e1942fbd4f40/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-manylinux2014\_s390x.manylinux\_2\_17\_s390x.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/4810c2c3-30ec-59bc-9c5e-dc4f8224933c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/2507377e-da96-593f-82c0-e981e32ca891/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-musllinux\_1\_2\_aarch64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/30692e3f-65db-5f78-87a3-ae8d58553514/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-musllinux\_1\_2\_armv7l.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/78f87be9-e3fb-5a2b-95d3-f99383c177b7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-musllinux\_1\_2\_x86\_64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/29d994e3-4d3f-5def-8a2b-29bb4784f737/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-pyemscripten\_2026\_0\_wasm32.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/008af537-eff4-504d-8f25-2178c52a7881/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### typst-0.15.2-cp39-abi3-win\_amd64.whl - [typst-0.15.2.dist-info/sboms/typst-py.cyclonedx.json](https://pypi.sbomify.com/artifact/cb81e8a8-e5d2-59bd-9698-6af99bd8b4be/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.38.4 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names | | [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.38.4 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0206](https://osv.dev/vulnerability/RUSTSEC-2026-0206) | unknown | rustybuzz 0.20.1 (crates.io) | none listed | \`rustybuzz\` is unmaintained | | [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.25.1 (crates.io) | none listed | \`ttf-parser\` is unmaintained | | [RUSTSEC-2024-0449](https://osv.dev/vulnerability/RUSTSEC-2024-0449) | unknown | unsafe-libyaml 0.2.11 (crates.io) | none listed | unsafe-libyaml is unmaintained | | [RUSTSEC-2024-0320](https://osv.dev/vulnerability/RUSTSEC-2024-0320) | unknown | yaml-rust 0.4.5 (crates.io) | none listed | yaml-rust is unmaintained. | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/typst@0.15.2 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/typst/0.15.2.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/typst/0.15.2