https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:31:35 +0000 https://vulnerability.circl.lu/vuln/cve-2018-17175 <p>In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema &#34;only&#34; option treats an empty list as implying no &#34;only&#34; option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the &#34;only&#34; option, and there is a user role that produces an empty value for &#34;only&#34;).</p> <p>In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema &#34;only&#34; option treats an empty list as implying no &#34;only&#34; option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the &#34;only&#34; option, and there is a user role that produces an empty value for &#34;only&#34;).</p> https://vulnerability.circl.lu/vuln/cve-2018-17175 https://vulnerability.circl.lu/vuln/ghsa-9q2p-fj49-vpxj <p><strong>Affected:</strong> PyPI: marshmallow</p> <p>In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema &#34;only&#34; option treats an empty list as implying no &#34;only&#34; option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the &#34;only&#34; option, and there is a user role that produces an empty value for &#34;only&#34;).</p> <p><strong>Affected:</strong> PyPI: marshmallow</p> <p>In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema &#34;only&#34; option treats an empty list as implying no &#34;only&#34; option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the &#34;only&#34; option, and there is a user role that produces an empty value for &#34;only&#34;).</p> https://vulnerability.circl.lu/vuln/ghsa-9q2p-fj49-vpxj https://vulnerability.circl.lu/vuln/pysec-2018-67 <p><strong>Affected:</strong> PyPI: marshmallow</p> <p>In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema &#34;only&#34; option treats an empty list as implying no &#34;only&#34; option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the &#34;only&#34; option, and there is a user role that produces an empty value for &#34;only&#34;).</p> <p><strong>Affected:</strong> PyPI: marshmallow</p> <p>In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema &#34;only&#34; option treats an empty list as implying no &#34;only&#34; option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the &#34;only&#34; option, and there is a user role that produces an empty value for &#34;only&#34;).</p> https://vulnerability.circl.lu/vuln/pysec-2018-67