spotipy-dev spotipy

• CVE-2025-66040 Low 3.6 Spotipy has a XSS vulnerability in OAuth callback server 0.2%
• CVE-2025-47928 Critical 9.1 Spotipy repo vulnerable to secrets exfiltration via `pull_request_target` 0.6%
• CVE-2025-27154 High 8.4 Spotipy's cache file, containing spotify auth token, is created with overly broad permissions 0.6%
• CVE-2023-23608 None 0.0 spotipy Path traversal vulnerability that may lead to type confusion in URI handling code 0.7%