Is vantage6 affected by GHSA-47w6-gwp4-w6vc?

PyPI vantage6 is affected in <= 5.0.2.

Is GHSA-47w6-gwp4-w6vc being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

high

GHSA-47w6-gwp4-w6vc

Q: Is GHSA-47w6-gwp4-w6vc being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

PyPI · vantage6

Summary

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Severity: high
CWE: CWE-863
Published: 2026-07-24
Updated: 2026-07-24

Advisory details

Impact

Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.

Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review

Patches

Workarounds

References

Related advisories

GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v5 — critical · Go/github.com/labstack/echo/v5
GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v4 — critical · Go/github.com/labstack/echo/v4
CVE-2026-77366 — critical · npm/obsidian-tc
CVE-2026-77459 — critical · Go/github.com/argoproj/argo-cd/v2
CVE-2026-68582 — critical · Go/code.vikunja.io/api
CVE-2026-105851 — critical · npm/payload
CVE-2026-100721 — critical · npm/vm2
CVE-2026-92951 — critical · npm/vm2

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.