MEDIUM6.5

PYSEC-2026-2059

Information leakage in YAQL

Quick fix

PYSEC-2026-2059 — yaql: upgrade to the fixed version with the command below.

pip install --upgrade 'yaql>=3.0.0'

Details

YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/yaql

Introduced in: 0Fixed in: 3.0.0

Fixpip install --upgrade 'yaql>=3.0.0'

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29156[ADVISORY]
https://bugs.launchpad.net/murano/+bug/2048114[WEB]
https://launchpad.net/bugs/2048114[WEB]
https://opendev.org/openstack/murano/tags[WEB]
https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3[WEB]
https://wiki.openstack.org/wiki/OSSN/OSSN-0093[WEB]
https://pypi.org/project/yaql[PACKAGE]
https://github.com/advisories/GHSA-mvf6-hwxh-7v76[ADVISORY]