Python packages vulnerable to pre-auth RCE via node2shell CVE-2026-111497 through Brotli
cyb3rops · x · 2026-10-24
Aikido Security reports that the node2shell vulnerability (CVE-2026-111497) also affects the Python ecosystem: pre-auth remote code execution is possible via Brotli decompression. Brotli is a hugely popular dependency (100M downloads/month), so many Python projects and major services are likely exposed. Patches are available and Aikido says its tooling detects the flaw.
More from Safety
- Critical vulnerabilities going parabolic: 14,943 published in Sept 2026 alone — luisdans · 2026-10-24
- Zvi's 'The Hackening': experts predict AI-driven internet hostility within 6-12 months — TheZvi · 2026-10-24
- OpenAI fired-researchers saga: METR terms in flux, leak accusations denied — sjgadler · 2026-10-24
- Security teams increasingly run open models via Ollama for red teaming — mchiang0610 · 2026-10-24
- France rebuilt its tax code as MLang, a formally verified open-source compiler — fkasummer · 2026-10-24
- AI cyberattacks cost $25-50 per attempt, recovery costs millions — OmarUFlorez · 2026-10-24