CVE-2026-25645: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
(updated )
The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-25645 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →