CRITICAL9.3
PYSEC-2026-309
ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function
Details
The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/chainerrl-visualizer
Introduced in:
0No fixed version published yet for chainerrl-visualizer (pip). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-31573[ADVISORY]
- https://github.com/github/securitylab/issues/669#issuecomment-1117265726[WEB]
- https://github.com/chainer/chainerrl-visualizer[PACKAGE]
- https://pypi.org/project/chainerrl-visualizer[PACKAGE]
- https://github.com/advisories/GHSA-687h-86vc-5x59[ADVISORY]