{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14101","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-19T15:35:50Z","dateUpdated":"2026-10-26T16:08:58Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code.\n\nENTRY\n  bravos/__init__.py (module-import: 3)\n\nPERSISTENCE\n  - Startup Persistence in bravos/adapters/cxg.py: \".profile\"\n  - Startup Persistence in bravos/adapters/cxg_bridge.py: \".profile\"\n  - Startup Persistence in bravos/adapters/cxg_report.py: \".profile\"\n  - Startup Persistence in bravos/cli.py: \".profile\"\n  - Startup Persistence in bravos/commands/auto.py: \".profile\"\n  - Startup Persistence in bravos/commands/env_cmd.py: \".profile\"\n  - Startup Persistence in bravos/commands/intake_cmd.py: \".profile\"\n  - Startup Persistence in bravos/commands/replay.py: \".profile\"\n  (+19 more)\n\nDESTINATION\n  - 18 exfil (custom-c2)\n  (values recorded in verified_iocs)\n\nEXFIL\n  - Corporate Environment Targeting in bravos/adapters/guardlink_model.py: \"tModel.unmitigated_exposures`, so the two surfaces that read them — the pentest\"\n  - Corporate Environment Targeting in bravos/coverage_inventory.py: \"tModel` and the round's :class:`~bravos.graph_worklist.Worklist`, so every branc...\"\n  - OAST/Interactsh Exfiltration in bravos/env/canary.py: \"oast.site\"\n  - OAST/Interactsh Exfiltration in bravos/intake/derive.py: \"oast.online\"\n  - Corporate Environment Targeting in bravos/sast_threat_match.py: \"tModel, facts: GraphFacts ) -\u003e tuple[tuple[SastFinding, ...], ThreatMatch\"\n  - Corporate Environment Targeting in bravos/targeting.py: \"tModel from .errors import BravosError from .models.cxg_execution import executi...\"\n  - Data Encoding for Exfiltration in bravos/artifact.py: \"base64.b64encode(\"\n  - Python File Upload to Remote in bravos/env/login.py: \"urllib.request.Request(url, data=\"\n  (+20 more)\n\nOBFUSCATION\n  - Unicode Escape Obfuscation in bravos/models/identity.py: \"\\u1680\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\"\n\nADDITIONAL FINDINGS\n  - Download Execute Delete Pattern in bravos/threat_draft.py: \"exec\", \"filesystem\", \"data_layer\"}) #: A call-chain segment (``std::fs::remove_f...\"\n  - Base64 Decoded Eval in bravos/web/assets/embed_assets.py: \"compile(r'(url\\(\"data:font/otf;base64\"\n  - Silent Process Execution in bravos/adapters/guardlink.py: \"stdin=DEVNULL\"\n  - Shell Command Execution in bravos/commands/config_cmd.py: \"subprocess.call(\"\n  - Dynamic Code Execution in bravos/models/sast.py: \"vm.runInContext\"\n  - Brand New Package\n\nPAYLOAD FILES\n  bravos/env/login.py (+ bravos/intake/derive.py, bravos/env/canary.py)","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/8f22bb02-565d-4b7f-8ef0-def4f6db5cde","name":"Malicious pypi package: bravos","tags":["advisory"]},{"url":"https://pypi.org/bravos","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"bravos","collectionURL":"https://pypi.org","packageName":"bravos","repo":"","defaultStatus":"affected","versions":[{"version":"0.6.0","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}