GHSA-rcrv-228c-gprj

Invalid URL generation in bitlyshortener

No scoreFix available

Impact

Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

Patches

Upgrading bitlyshortener to 0.6.0 or newer will prevent the generation such invalid short URLs.

Workarounds

A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

References

Release notes

What each source reports

GitHub AdvisoriesNo score

Invalid URL generation in bitlyshortener

Impact

Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

Patches

Upgrading bitlyshortener to 0.6.0 or newer will prevent the generation such invalid short URLs.

Workarounds

A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

References

Release notes

Record: GHSA-rcrv-228c-gprj
Updated: 2026-11-02

OSVNo score

Invalid URL generation in bitlyshortener

Impact

Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

Patches

Upgrading bitlyshortener to 0.6.0 or newer will prevent the generation such invalid short URLs.

Workarounds

A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

References

Release notes

Record: GHSA-rcrv-228c-gprj
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`bitlyshortener` PyPI	before 0.6.0	0.6.0
`bitlyshortener` PyPI	before 0.6.0, plus listed versions 0.0.30.0.40.0.50.0.60.0.7 Show 28 moreShow less 0.0.80.0.90.1.10.1.20.1.30.1.40.1.50.1.60.2.00.2.10.2.20.2.30.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.70.4.00.4.10.4.20.4.30.5.00.5.10.5.20.5.3	0.6.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-rcrv-228c-gprj is a vulnerability with no CVSS score yet in bitlyshortener, published January 21, 2022. No source lists public exploit code. Fixed in bitlyshortener 0.6.0.