{"id":"PYSEC-2026-926","summary":"Path traversal in spotipy","details":"### Summary\nIf a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended.\n\n### Details\nThe [code Spotipy uses to parse URIs and URLs ](https://github.com/spotipy-dev/spotipy/blob/master/spotipy/client.py#L1942) accepts user data too liberally which allows a malicious user to insert arbitrary characters into the path that is used for API requests. Because it is possible to include `..`, an attacker can redirect for example a track lookup via `spotifyApi.track()` to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well.\n\nBefore the security advisory feature was enabled on GitHub, I was already in contact with Stéphane Bruckert via e-mail, and he asked me to look into a potential fix. \n\nMy recommendation is to perform stricter parsing of URLs and URIs, which I implemented in the patch included at the end of the report. If you prefer, I can also invite you to a private fork of the repository.\n\n### Impact\nThe impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API.\n","aliases":["CVE-2023-23608","GHSA-q764-g6fm-555v"],"modified":"2026-07-07T11:45:51.176510806Z","published":"2026-07-07T10:17:27.104783Z","references":[{"type":"WEB","url":"https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23608"},{"type":"PACKAGE","url":"https://github.com/spotipy-dev/spotipy"},{"type":"PACKAGE","url":"https://pypi.org/project/spotipy"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q764-g6fm-555v"}],"affected":[{"package":{"name":"spotipy","ecosystem":"PyPI","purl":"pkg:pypi/spotipy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.1"}]}],"versions":["0.1","0.2","2.0.1","2.0.2","2.1.0","2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.16.1","2.17.0","2.17.1","2.18.0","2.19.0","2.19.0rc1","2.2.0","2.20.0","2.21.0","2.22.0","2.3.0","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.6.0","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.8.0","2.9.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/spotipy/PYSEC-2026-926.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}]}