{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000588","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-25T21:53:59Z","dateUpdated":"2026-10-25T21:53:59Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"The notebook_payload rule (NotebookPayloadRule, on by default) tokenises the shell lines in a scanned Jupyter notebook's cells with Python's shlex: the %alias_magic arguments in _ipython_cells._define_magic_alias since 1.0.0rc2, and every shell line in _ipython_cells._shell_words, used by local_scripts, since 1.0.0rc3. shlex takes time quadratic in the length of one unquoted run, so a single long line in a notebook anywhere in a scanned tree, such as a repository, pull request, model bundle or upload, can stall a scan. Only availability is affected. Affects 1.0.0rc2 through 1.0.0rc5. Version 1.0.0 does not pass a line longer than 32 KiB to shlex: an over-long shell line or %alias_magic argument is reported as not read, and the cell's result is inconclusive.","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/guardana-rules/","name":"","tags":["advisory"]},{"url":"https://github.com/guardana/guardana/commit/b4bb24fe0648cd4a55ed2b85e6cdbe44f1f04136","name":"Fix: guardana#208","tags":["fix"]},{"url":"https://github.com/guardana/guardana/commit/5922f854cb6651b79fdc4ff0ed9666527e662ec8","name":"Fix: guardana#216","tags":["fix"]},{"url":"https://github.com/guardana/guardana","name":"","tags":["web"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Uncontrolled Resource Consumption","cweId":"CWE-400","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Inefficient Algorithmic Complexity","cweId":"CWE-407","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"guardana-rules","collectionURL":"https://pypi.org","packageName":"guardana-rules","repo":"","defaultStatus":"unaffected","versions":[{"version":"1.0.0rc2","status":"affected","versionType":"python","lessThan":"1.0.0","lessThanOrEqual":"","changes":null},{"version":"1.0.0","status":"unaffected","versionType":"python","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":["guardana.rules.supply_chain._ipython_cells","guardana.rules.supply_chain.notebook_payload"],"programFiles":["guardana/rules/supply_chain/_ipython_cells.py","guardana/rules/supply_chain/notebook_payload.py"],"programRoutines":[{"name":"guardana.rules.supply_chain._ipython_cells._shell_words"},{"name":"guardana.rules.supply_chain._ipython_cells.local_scripts"},{"name":"guardana.rules.supply_chain._ipython_cells._define_magic_alias"},{"name":"guardana.rules.supply_chain.notebook_payload.NotebookPayloadRule"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}