pypi package report

Is microdot safe?

1 known vulnerability, worst severity LOW.

cvss

3.7

how bad it is if exploited, out of 10

epss

0.20%

chance of exploitation in the next 30 days

xyz score

1.1

CyberXYZ composite, out of 10

fig. 01 — GHSA-7wc8-wvc4-m498, the advisory selected below

// advisories

GHSA-7wc8-wvc4-m498

LOWCVE-2026-42874

The Response.setcookie() method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n sequence in them. This can be a potential source of header injection attacks.

Affected: < 2.6.1
Fixed in: 2.6.1
Weakness: CWE-113
Published: 2026-05-05
Source: github

GHSA NVD MITRE reference reference reference

// dependencies

0 direct

// ai model usage

No published models are known to use this package.

Checked 2026-09-22 at 02:34 UTC. The most recent advisory here was published 2026-05-05. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is microdot safe? pypi package security report | CyberXYZ