GHSA-xm4r-5rj9-2pg3

gratient 0.5 contains credential harvesting code

8.7 High

gratient is a user-facing library for generating color gradients of text. Version 0.5 contained obfuscated, malicious code targeting Windows platforms, harvesting information and credentials from the user's system and sending them to a remote server. Services may include Mullvad VPN and Telegram.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

What each source reports

GitHub Advisories Score used8.7

gratient 0.5 contains credential harvesting code

Record: GHSA-xm4r-5rj9-2pg3
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSV8.7

gratient 0.5 contains credential harvesting code

Record: GHSA-xm4r-5rj9-2pg3
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`gratient` PyPI	0.5 to 0.5	None known
`gratient` PyPI	Listed versions 0.5	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-xm4r-5rj9-2pg3 is a high vulnerability (CVSS 8.7) in gratient, published August 30, 2024. No source lists public exploit code. No source names a fixed version.