HIGHPyPI
GHSA-pwhh-q4h6-w599· CVE-2025-27154, PYSEC-2026-1936Spotipy's cache file, containing spotify auth token, is created with overly broad permissions
Modified: 9/10/2026
package
PyPI/spotipy
pkg:pypi/spotipy
MEDIUM5.4PyPI
GHSA-q764-g6fm-555v· CVE-2023-23608, PYSEC-2026-926Path traversal in spotipy
Modified: 9/10/2026
LOW3.6PyPI
GHSA-r77h-rpp9-w2xm· CVE-2025-66040, PYSEC-2026-1937Spotipy has a XSS vulnerability in its OAuth callback server
Modified: 7/7/2026
—PyPI
PYSEC-2026-1936· CVE-2025-27154, GHSA-pwhh-q4h6-w599Spotipy's cache file, containing spotify auth token, is created with overly broad permissions
Modified: 7/7/2026
LOW3.6PyPI
PYSEC-2026-1937· CVE-2025-66040, GHSA-r77h-rpp9-w2xmSpotipy has a XSS vulnerability in its OAuth callback server
Modified: 7/7/2026
MEDIUM5.4PyPI
PYSEC-2026-926· CVE-2023-23608, GHSA-q764-g6fm-555vPath traversal in spotipy
Modified: 7/7/2026