Vulnerability · Published Jan 24, 2023 · Assigned by GitHub_M

CVE-2023-23608spotipy Path traversal vulnerability that may lead to type confusion in URI handling code

None 0.0

In plain English

A path traversal in spotipy from spotipy-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)0.0None

Exploit odds (30 days)0.7%top 48.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include "..", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	spotipy	2.22.1	GHSA-q764-g6fm-555v
PyPI	spotipy	2.22.1	PYSEC-2026-926

Affected products (as reported)

Vendor	Product	Versions
spotipy-dev	spotipy	< 2.22.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

References

https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v x_refsource_CONFIRM