Vulnerable Library - python_dotenv-1.0.0-py3-none-any.whl
Read key-value pairs from a .env file and set them as environment variables
Library home page: https://files.pythonhosted.org/packages/44/2f/62ea1c8b593f4e093cc1a7768f0d46112107e790c3e478532329e434f00b/python_dotenv-1.0.0-py3-none-any.whl
Sample Path to Dependency File: /modules/programming/module_programming_llm/.ws-temp-QQXLZB-requirements.txt
Path to vulnerable library: /modules/programming/module_programming_llm/.ws-temp-QQXLZB-requirements.txt,/llm_core/.ws-temp-UUSECC-requirements.txt,/modules/modeling/module_modeling_llm/.ws-temp-FXAQNG-requirements.txt,/modules/text/module_text_llm/.ws-temp-YBCMOS-requirements.txt
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (python_dotenv version) |
Remediation Possible** |
| CVE-2026-28684 |
 Medium |
6.6 |
python_dotenv-1.0.0-py3-none-any.whl |
Direct |
1.2.2 |
❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-28684
Vulnerable Library - python_dotenv-1.0.0-py3-none-any.whl
Read key-value pairs from a .env file and set them as environment variables
Library home page: https://files.pythonhosted.org/packages/44/2f/62ea1c8b593f4e093cc1a7768f0d46112107e790c3e478532329e434f00b/python_dotenv-1.0.0-py3-none-any.whl
Sample Path to Dependency File: /modules/programming/module_programming_llm/.ws-temp-QQXLZB-requirements.txt
Path to vulnerable library: /modules/programming/module_programming_llm/.ws-temp-QQXLZB-requirements.txt,/llm_core/.ws-temp-UUSECC-requirements.txt,/modules/modeling/module_modeling_llm/.ws-temp-FXAQNG-requirements.txt,/modules/text/module_text_llm/.ws-temp-YBCMOS-requirements.txt
Dependency Hierarchy:
- ❌ python_dotenv-1.0.0-py3-none-any.whl (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, "set_key()" and "unset_key()" in python-dotenv follow symbolic links when rewriting ".env" files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
Publish Date: 2026-04-20
URL: CVE-2026-28684
CVSS 3 Score Details (6.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-mf9w-mj56-hr94
Release Date: 2026-04-20
Fix Resolution: 1.2.2
Step up your Open Source Security Game with Mend here
Read key-value pairs from a .env file and set them as environment variables
Library home page: https://files.pythonhosted.org/packages/44/2f/62ea1c8b593f4e093cc1a7768f0d46112107e790c3e478532329e434f00b/python_dotenv-1.0.0-py3-none-any.whl
Sample Path to Dependency File: /modules/programming/module_programming_llm/.ws-temp-QQXLZB-requirements.txt
Path to vulnerable library: /modules/programming/module_programming_llm/.ws-temp-QQXLZB-requirements.txt,/llm_core/.ws-temp-UUSECC-requirements.txt,/modules/modeling/module_modeling_llm/.ws-temp-FXAQNG-requirements.txt,/modules/text/module_text_llm/.ws-temp-YBCMOS-requirements.txt
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - python_dotenv-1.0.0-py3-none-any.whl
Read key-value pairs from a .env file and set them as environment variables
Library home page: https://files.pythonhosted.org/packages/44/2f/62ea1c8b593f4e093cc1a7768f0d46112107e790c3e478532329e434f00b/python_dotenv-1.0.0-py3-none-any.whl
Sample Path to Dependency File: /modules/programming/module_programming_llm/.ws-temp-QQXLZB-requirements.txt
Path to vulnerable library: /modules/programming/module_programming_llm/.ws-temp-QQXLZB-requirements.txt,/llm_core/.ws-temp-UUSECC-requirements.txt,/modules/modeling/module_modeling_llm/.ws-temp-FXAQNG-requirements.txt,/modules/text/module_text_llm/.ws-temp-YBCMOS-requirements.txt
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, "set_key()" and "unset_key()" in python-dotenv follow symbolic links when rewriting ".env" files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
Publish Date: 2026-04-20
URL: CVE-2026-28684
CVSS 3 Score Details (6.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-mf9w-mj56-hr94
Release Date: 2026-04-20
Fix Resolution: 1.2.2
Step up your Open Source Security Game with Mend here