GHSA-486g-47cc-8wxf

aiocpa contains credential harvesting code

8.3 High

aiocpa is a user-facing library for generating color gradients of text. Version 0.1.13 introduced obfuscated, malicious code targeting Crypto Pay users, forwarding client credentials to a remote Telegram bot. All versions have been removed from PyPI.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

What each source reports

GitHub Advisories Score used8.3

aiocpa contains credential harvesting code

Record: GHSA-486g-47cc-8wxf
CVSS 4.0: 8.3 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSV8.3

aiocpa contains credential harvesting code

Record: GHSA-486g-47cc-8wxf
CVSS 4.0: 8.3 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`aiocpa` PyPI	0.1.13 to 0.1.14	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-486g-47cc-8wxf is a high vulnerability (CVSS 8.3) in aiocpa, published November 25, 2024. No source lists public exploit code. No source names a fixed version.