{"id":"GHSA-5qvp-pr9f-2g2v","summary":"poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645","details":"Pin vulnerable version of requests library","modified":"2026-04-01T21:04:43.804300Z","published":"2026-04-01T20:52:20Z","database_specific":{"cwe_ids":["CWE-377"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-04-01T20:52:20Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"WEB","url":"https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/security/advisories/GHSA-5qvp-pr9f-2g2v"},{"type":"WEB","url":"https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/commit/54b5784d89f36cd413a8bc5032ab0a96438dcae3"},{"type":"PACKAGE","url":"https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version"},{"type":"WEB","url":"https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/releases/tag/1.5.6"}],"affected":[{"package":{"name":"poetry-plugin-tweak-dependencies-version","ecosystem":"PyPI","purl":"pkg:pypi/poetry-plugin-tweak-dependencies-version"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6"}]}],"versions":["0.1.0","0.1.6","0.1.7","0.2.0","0.2.1","1.0.0","1.1.0","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.5.1","1.5.2","1.5.4","1.5.5"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.5.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5qvp-pr9f-2g2v/GHSA-5qvp-pr9f-2g2v.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}]}