In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema…
Priority LOW 28CWE-358Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
Why it matters now
EPSS 0.01919 80th percentileScored 2026-11-07
Fix Fixed marshmallow (PyPI): 2.15.1, 3.0.0b9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | marshmallow (PyPI) | before 2.15.1 | 2.15.1 | Patch available | GHSA-9q2p-fj49-vpxj |
| — | marshmallow (PyPI) | 3.0a0 to before 3.0.0b9 | 3.0.0b9 | Patch available | GHSA-9q2p-fj49-vpxj |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- marshmallow (PyPI) Vendor— Affected before 2.15.1 Fixed in 2.15.1 Patch available GHSA-9q2p-fj49-vpxj
- marshmallow (PyPI) Vendor— Affected 3.0a0 to before 3.0.0b9 Fixed in 3.0.0b9 Patch available GHSA-9q2p-fj49-vpxj
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:marshmallow_project:marshmallow:*:*:*:*:*:*:*:* | before 2.15.1 | Vulnerable | Marshmallow Project |
| cpe:2.3:a:marshmallow_project:marshmallow:*:*:*:*:*:python:*:* | 3.0 to before 3.0.0b9 | Vulnerable | Marshmallow Project |
- cpe:2.3:a:marshmallow_project:marshmallow:*:*:*:*:*:*:*:* Versions before 2.15.1 Vulnerable ·Marshmallow Project
- cpe:2.3:a:marshmallow_project:marshmallow:*:*:*:*:*:python:*:* Versions 3.0 to before 3.0.0b9 Vulnerable ·Marshmallow Project
Remediation
- Fix · GHSA-9q2p-fj49-vpxj marshmallow (PyPI) Fixed in 2.15.1 Advisory →
- Fix · GHSA-9q2p-fj49-vpxj marshmallow (PyPI) Fixed in 3.0.0b9 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2018-17175
- 2026-10-03 Alias added: GHSA-9q2p-fj49-vpxj
References
Advisory 4
Sources
- CVE-2018-17175 · CVE Program
- CVE-2018-17175 · NVD
- FIRST EPSS
- GHSA-9q2p-fj49-vpxj · GitHub Advisory Database · CC BY 4.0
- CVE-2018-17175 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences