pypi package report

Is fiona safe?

2 known vulnerabilities, worst severity CRITICAL.

// reach

10 direct dependencies

2 carry known advisories, worst CRITICAL

18 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
9.8
critical

CVSS v3.1 base score out of 10

epss
not scored

chance of exploitation in 30 days

xyz score
5.0
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-q5fm-55c2-v6j9, the advisory selected below

// 2 advisories

GHSA-q5fm-55c2-v6j9

CRITICALGitHub rating
// summary

Vulnerability scan of fiona shows CVE-2023-45853. The vulnerability is in GDAL, a dependency of fiona.

// details

Fiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.

The Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.

// impact

Systems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Checked 2026-11-06 at 23:32 UTC. The most recent advisory here was published 2024-07-16. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.