The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
pypi package report
Is duplicity safe?
1 known vulnerability, worst severity MODERATE.
// reach
0 packages depend on it
an advisory here reaches each of them
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
No published models are known to use this package.
cvss
5.0
medium
severity band, no base score published
epss
0.37%
low
chance of exploitation in 30 days, 32nd percentile of all CVEs
xyz score
not scored
CyberXYZ composite out of 10
fig. 01 — GHSA-wxcw-rqxc-hj85, the advisory selected below
// 1 advisories
Checked 2026-11-06 at 22:26 UTC. The most recent advisory here was published 2022-05-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.