GHSA-jxr6-qrxx-2ph2
num2words subjected to phishing attack, two versions published containing malware
GHSA-jxr6-qrxx-2ph2 is a critical vulnerability (CVSS 9.3) in num2words, published July 31, 2025. No source lists public exploit code. No source names a fixed version.
- Severity
- 9.3 CriticalCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The num2words project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
What each source reports
GitHub Advisories Score used
num2words subjected to phishing attack, two versions published containing malware
The num2words project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.
- Record
GHSA-jxr6-qrxx-2ph2- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-506
- Updated
- 2026-11-02
OSV
num2words subjected to phishing attack, two versions published containing malware
The num2words project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.
- Record
GHSA-jxr6-qrxx-2ph2- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-506
- Updated
- 2026-11-02
OSVMAL-2025-6794No score
Malicious code in num2words (PyPI)
-= Per source details. Do not edit below this line.=-
Source: ghsa-malware (23a528edd10eb63e7c7932830fdb314983cadc840ce8ccfbaa04ad821bbdc1da)
The num2words project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.
Source: google-open-source-security (36822c42f7e862f29cef9734efec9a9a9cc44a80e619e954dd25c12239d15767)
The num2words project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code.
- Record
MAL-2025-6794- Updated
- 2026-11-02
OSVPYSEC-2025-72No score
After a successful phishing attack, new versions of `num2words` were published containing malware.
The num2words project was compromised via a phishing attack
and two new versions were uploaded to PyPI containing malicious code.
The affected versions have been removed from PyPI,
and users are advised to remove the affected versions from their environments.
- Record
PYSEC-2025-72- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/pypa/advisory-database/tree/main/vulns/num2words/PYSEC-2025-72.yaml
nitter.tiekoetter.com/SFLinux/status/1949906299308953827
stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise