PYSEC-2025-2
uniapi version 1.0.7 contained an information harvesting script.
uniapi version 1.0.7 introduces code that would execute
on import of the module and download a script from a remote URL,
and would then execute the downloaded script in a thread.
The downloaded script would harvest system information
and POST the information to another remote URL.
This code was found in the PyPI release artifacts and was not present
in the public GitHub repository.
What each source reports
OSV No score
uniapi version 1.0.7 contained an information harvesting script.
uniapi version 1.0.7 introduces code that would execute
on import of the module and download a script from a remote URL,
and would then execute the downloaded script in a thread.
The downloaded script would harvest system information
and POST the information to another remote URL.
This code was found in the PyPI release artifacts and was not present
in the public GitHub repository.
- Record
PYSEC-2025-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uniapiPyPI |
Listed versions 1.0.7 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
PYSEC-2025-2 is a vulnerability with no CVSS score yet in uniapi, published January 24, 2025. No source lists public exploit code. No source names a fixed version.