CVE-2023-23608 json
spotipy Path traversal vulnerability that may lead to type confusion in URI handling code
published 2023-01-23 3 y ago modified 2026-09-10 1 mo ago also GHSA-q764-g6fm-555v , PYSEC-2026-926 , EUVD-2023-0527
- cvss
- 0.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include "..", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.
Patch / fix
- pypi spotipy 2.22.1
- spotipy_project spotipy 2.22.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | spotipy | <2.22.1 |
2.22.1 |
Affected products
- spotipy-dev spotipy
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v
web, exploit, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-23608
advisory
-
github.com
/spotipy-dev/spotipy
package
-
pypi.org
/project/spotipy
package
-
github.com
/advisories/GHSA-q764-g6fm-555v
advisory
Sources
- CVE List CVE-2023-23608
- GitHub Advisory GHSA-q764-g6fm-555v
- NVD CVE-2023-23608
- OSV PYSEC-2026-926
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.