Vulnerability-Lookup

CVE-2023-23608 (GCVE-0-2023-23608)

Vulnerability from cvelistv5 – Published: 2023-01-24 02:39 – Updated: 2025-03-10 21:20

Title

spotipy Path traversal vulnerability that may lead to type confusion in URI handling code

Summary

Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include "..", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.

Severity

0 (None)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-10 21:01 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/spotipy-dev/spotipy/security/a…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
spotipy-dev	spotipy	Affected: < 2.22.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:35:33.604Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-23608",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T21:01:25.550140Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T21:20:38.544Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spotipy",
          "vendor": "spotipy-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.22.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include \"..\", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-24T02:39:32.471Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
        }
      ],
      "source": {
        "advisory": "GHSA-q764-g6fm-555v",
        "discovery": "UNKNOWN"
      },
      "title": "spotipy Path traversal vulnerability that may lead to type confusion in URI handling code"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-23608",
    "datePublished": "2023-01-24T02:39:32.471Z",
    "dateReserved": "2023-01-16T17:07:46.241Z",
    "dateUpdated": "2025-03-10T21:20:38.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-23608",
      "date": "2026-10-03",
      "epss": "0.00658",
      "percentile": "0.49752"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T10:35:33.604Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-23608",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-10T21:01:25.550140Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-10T21:01:26.835Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "spotipy",
              "vendor": "spotipy-dev",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.22.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include \"..\", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 0,
                "baseSeverity": "NONE",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-01-24T02:39:32.471Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
            }
          ],
          "source": {
            "advisory": "GHSA-q764-g6fm-555v",
            "discovery": "UNKNOWN"
          },
          "title": "spotipy Path traversal vulnerability that may lead to type confusion in URI handling code"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2023-23608",
        "datePublished": "2023-01-24T02:39:32.471Z",
        "dateReserved": "2023-01-16T17:07:46.241Z",
        "dateUpdated": "2025-03-10T21:20:38.544Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-23608

Vulnerability from fkie_nvd - Published: 2023-01-26 21:18 - Updated: 2026-06-17 05:37

Severity

0.0 (None) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v	Exploit, Patch, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v	Exploit, Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	spotipy_project	spotipy	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "spotipy",
          "vendor": "spotipy-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.22.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:spotipy_project:spotipy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C17C21F5-9A7F-4AA9-BC95-746B70973C6D",
              "versionEndExcluding": "2.22.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include \"..\", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1."
    },
    {
      "lang": "es",
      "value": "Spotipy es una librer\u00eda Python liviana para la API web de Spotify. En versiones anteriores a la 2.22.1, si se pasa un URI malicioso a la librer\u00eda, se puede enga\u00f1ar a la librer\u00eda para que realice una operaci\u00f3n en un endpoint de API diferente al previsto. El c\u00f3digo que utiliza Spotipy para analizar URI y URL permite a un atacante insertar caracteres arbitrarios en la ruta que se utiliza para las solicitudes de API. Debido a que es posible incluir \"..\", un atacante puede redirigir, por ejemplo, una b\u00fasqueda de pistas a trav\u00e9s de spotifyApi.track() a un endpoint API arbitrario como listas de reproducci\u00f3n, pero esto tambi\u00e9n es posible para otros endpoints. El impacto de esta vulnerabilidad depende en gran medida de las operaciones que realiza una aplicaci\u00f3n cliente cuando maneja un URI de un usuario y c\u00f3mo utiliza las respuestas que recibe de la API. Este problema se solucion\u00f3 en la versi\u00f3n 2.22.1."
    }
  ],
  "id": "CVE-2023-23608",
  "lastModified": "2026-06-17T05:37:34.357",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 0.0,
          "baseSeverity": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 0.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-23608",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-10T21:01:25.550140Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-01-26T21:18:13.963",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-Q764-G6FM-555V

Vulnerability from github – Published: 2023-01-23 22:05 – Updated: 2023-02-07 04:11

Summary

Path traversal in spotipy

Details

Summary

If a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended.

Details

The code Spotipy uses to parse URIs and URLs accepts user data too liberally which allows a malicious user to insert arbitrary characters into the path that is used for API requests. Because it is possible to include .., an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well.

Before the security advisory feature was enabled on GitHub, I was already in contact with Stéphane Bruckert via e-mail, and he asked me to look into a potential fix.

My recommendation is to perform stricter parsing of URLs and URIs, which I implemented in the patch included at the end of the report. If you prefer, I can also invite you to a private fork of the repository.

Impact

The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "spotipy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.22.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-23608"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-23T22:05:11Z",
    "nvd_published_at": "2023-01-26T21:18:00Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nIf a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended.\n\n### Details\nThe [code Spotipy uses to parse URIs and URLs ](https://github.com/spotipy-dev/spotipy/blob/master/spotipy/client.py#L1942) accepts user data too liberally which allows a malicious user to insert arbitrary characters into the path that is used for API requests. Because it is possible to include `..`, an attacker can redirect for example a track lookup via `spotifyApi.track()` to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well.\n\nBefore the security advisory feature was enabled on GitHub, I was already in contact with St\u00e9phane Bruckert via e-mail, and he asked me to look into a potential fix. \n\nMy recommendation is to perform stricter parsing of URLs and URIs, which I implemented in the patch included at the end of the report. If you prefer, I can also invite you to a private fork of the repository.\n\n### Impact\nThe impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API.\n",
  "id": "GHSA-q764-g6fm-555v",
  "modified": "2023-02-07T04:11:52Z",
  "published": "2023-01-23T22:05:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23608"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spotipy-dev/spotipy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Path traversal in spotipy"
}

GSD-2023-23608

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-23608

Aliases

CVE-2023-23608

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-23608",
    "id": "GSD-2023-23608",
    "references": [
      "https://www.suse.com/security/cve/CVE-2023-23608.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-23608"
      ],
      "details": "Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include \"..\", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.",
      "id": "GSD-2023-23608",
      "modified": "2023-12-13T01:20:49.827378Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-23608",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "spotipy",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 2.22.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "spotipy-dev"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include \"..\", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-22",
                "lang": "eng",
                "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v",
            "refsource": "MISC",
            "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-q764-g6fm-555v",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c2.22.1",
          "affected_versions": "All versions before 2.22.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937",
            "CWE-79"
          ],
          "date": "2023-02-06",
          "description": "Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include \"..\", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.",
          "fixed_versions": [
            "2.22.1"
          ],
          "identifier": "CVE-2023-23608",
          "identifiers": [
            "CVE-2023-23608",
            "GHSA-q764-g6fm-555v",
            "GMS-2023-102"
          ],
          "not_impacted": "All versions starting from 2.22.1",
          "package_slug": "pypi/spotipy",
          "pubdate": "2023-01-26",
          "solution": "Upgrade to version 2.22.1 or above.",
          "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-23608",
            "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v",
            "https://github.com/advisories/GHSA-q764-g6fm-555v"
          ],
          "uuid": "074ecd67-b6f5-4109-95a5-650d71c7e565"
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions before 2.22.1",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2023-01-23",
          "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) in spotipy.",
          "fixed_versions": [
            "2.22.1"
          ],
          "identifier": "GMS-2023-102",
          "identifiers": [
            "GHSA-q764-g6fm-555v",
            "GMS-2023-102",
            "CVE-2023-23608"
          ],
          "not_impacted": "All versions starting from 2.22.1",
          "package_slug": "pypi/spotipy",
          "pubdate": "2023-01-23",
          "solution": "Upgrade to version 2.22.1 or above.",
          "title": "Duplicate of ./pypi/spotipy/CVE-2023-23608.yml",
          "urls": [
            "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v",
            "https://github.com/advisories/GHSA-q764-g6fm-555v"
          ],
          "uuid": "3276f528-d6e2-47fe-af92-a36e247add36"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:spotipy_project:spotipy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.22.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-23608"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include \"..\", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2023-02-06T17:23Z",
      "publishedDate": "2023-01-26T21:18Z"
    }
  }
}

PYSEC-2026-926

Vulnerability from pysec - Published: 2026-07-07 10:17 - Updated: 2026-07-07 11:31

Details

Summary

If a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended.

Details

Before the security advisory feature was enabled on GitHub, I was already in contact with Stéphane Bruckert via e-mail, and he asked me to look into a potential fix.

Impact

The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Impacted products

Name	purl
spotipy	pkg:pypi/spotipy

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "spotipy",
        "purl": "pkg:pypi/spotipy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.22.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1",
        "0.2",
        "2.0.1",
        "2.0.2",
        "2.1.0",
        "2.10.0",
        "2.11.0",
        "2.11.1",
        "2.11.2",
        "2.12.0",
        "2.13.0",
        "2.14.0",
        "2.15.0",
        "2.16.0",
        "2.16.1",
        "2.17.0",
        "2.17.1",
        "2.18.0",
        "2.19.0",
        "2.19.0rc1",
        "2.2.0",
        "2.20.0",
        "2.21.0",
        "2.22.0",
        "2.3.0",
        "2.3.2",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.3.6",
        "2.3.7",
        "2.3.8",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.5.0",
        "2.6.0",
        "2.6.1",
        "2.6.2",
        "2.6.3",
        "2.7.0",
        "2.7.1",
        "2.8.0",
        "2.9.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-23608",
    "GHSA-q764-g6fm-555v"
  ],
  "details": "### Summary\nIf a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended.\n\n### Details\nThe [code Spotipy uses to parse URIs and URLs ](https://github.com/spotipy-dev/spotipy/blob/master/spotipy/client.py#L1942) accepts user data too liberally which allows a malicious user to insert arbitrary characters into the path that is used for API requests. Because it is possible to include `..`, an attacker can redirect for example a track lookup via `spotifyApi.track()` to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well.\n\nBefore the security advisory feature was enabled on GitHub, I was already in contact with St\u00e9phane Bruckert via e-mail, and he asked me to look into a potential fix. \n\nMy recommendation is to perform stricter parsing of URLs and URIs, which I implemented in the patch included at the end of the report. If you prefer, I can also invite you to a private fork of the repository.\n\n### Impact\nThe impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API.\n",
  "id": "PYSEC-2026-926",
  "modified": "2026-07-07T11:31:08.376916Z",
  "published": "2026-07-07T10:17:27.104783Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23608"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spotipy-dev/spotipy"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/spotipy"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-q764-g6fm-555v"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Path traversal in spotipy"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-23608 (GCVE-0-2023-23608)

FKIE_CVE-2023-23608

GHSA-Q764-G6FM-555V

Summary

Details

Impact

GSD-2023-23608

PYSEC-2026-926

Summary

Details

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour