PyPI: koji

CVE-2017-1002153

Safety vulnerability ID: SFTY-20171006-65188

Safety legacy ID: pyup.io-66904

Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.

PyPI

NVD

GHSA

Created at: Jul 5, 2026Updated at: Jul 5, 2026

Overview

Koji blacklisted paths workaround

Advisory

Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.

Affected Package

Affecting koji package, versions==1.13.0

Also affects

---

How to Fix

Upgradekojito1.15.0or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

https://getsafety.com/vulnerabilities/SFTY-20171006-65188/CVE-2017-1002153
https://nvd.nist.gov/vuln/detail/CVE-2017-1002153
https://pagure.io/koji/issue/563
https://github.com/pypa/advisory-database/tree/main/vulns/koji/PYSEC-2017-144.yaml
https://github.com/advisories/GHSA-vwp5-w4rq-g4cc

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more