pypi package report

Is psutil safe?

1 known vulnerability, worst severity HIGH.

// reach

1 direct dependencies

none carry a known advisory

    776 packages depend on it

    an advisory here reaches each of them

    Create a free accountfor every dependency path, dependent and what to upgrade
    // ai models

    1 published models carry an advisory from this package

    0 pin a version the advisory is confirmed against; the rest declare it without a version.

    DeepMostInnovations/sales-conversion-model-reinf-learningHIGHnot pinned

    2 published models

    0 declared · 2 observed · 0 inferred

    ModelEvidence
    CodeMasterCody3D/taardis-27b-full-ternaryobserved
    DeepMostInnovations/sales-conversion-model-reinf-learningobserved

    2 published AI models are associated with this package: 0 name it in a requirements or pyproject file, 2 load it or import it directly, and 0 are inferred from the runtime stack their declared library pulls in. Only 0 state a version requirement, so this is not a count of affected models.


    cvss
    7.5
    high

    CVSS v3.1 base score out of 10

    epss
    3.5%
    medium

    chance of exploitation in 30 days, 89th percentile of all CVEs

    xyz score
    5.1
    medium

    CyberXYZ composite out of 10

    fig. 01 — GHSA-qfc5-mcwq-26q8, the advisory selected below

    // 1 advisories

    GHSA-qfc5-mcwq-26q8

    HIGHGitHub ratingCVE-2019-18874

    psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

    // cvss v3.1 vector

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    Attack vector
    Network
    Attack complexity
    Low
    Privileges required
    None
    User interaction
    None
    Scope
    Unchanged
    Confidentiality
    None
    Integrity
    None
    Availability
    High

    Checked 2026-11-06 at 22:03 UTC. The most recent advisory here was published 2020-03-12. Updated continuously from NVD, GHSA, OSV and CNA feeds.

    Think a verdict here is wrong? Tell us — we respond within 2 business days.