pygments-2.19.2-py3-none-any.whl: 1 vulnerabilities (highest severity is: 3.3)

Assessment

Research direction

Description

Vulnerable Library - pygments-2.19.2-py3-none-any.whl

Pygments is a syntax highlighting package written in Python.

Library home page: https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl

Path to dependency file: /tmp/ws-scm/sql-cli

Path to vulnerable library: /tmp/ws-ua_20260518195424_ZCYUWM/python_XKNQIE/202605181954251/env/lib/python3.12/site-packages/pygments-2.19.2.dist-info

Found in HEAD commit: 68212e0c681da02608aa39ca6a7234d5a082124e

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (pygments version)	Remediation Possible**
CVE-2026-4539	Low	3.3	pygments-2.19.2-py3-none-any.whl	Direct	pygments - 2.20.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-4539

Vulnerable Library - pygments-2.19.2-py3-none-any.whl

Pygments is a syntax highlighting package written in Python.

Library home page: https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl

Path to dependency file: /tmp/ws-scm/sql-cli

Path to vulnerable library: /tmp/ws-ua_20260518195424_ZCYUWM/python_XKNQIE/202605181954251/env/lib/python3.12/site-packages/pygments-2.19.2.dist-info

Dependency Hierarchy:

• ❌ pygments-2.19.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 68212e0c681da02608aa39ca6a7234d5a082124e

Found in base branch: main

Vulnerability Details

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Publish Date: 2026-03-22

URL: CVE-2026-4539

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-5239-wwwm-4pmq

Release Date: 2026-03-22

Fix Resolution: pygments - 2.20.0

Contributor guide

Open the contributing guide

First steps

1. Read the whole issue, then the project's contributing guide.
2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
3. Fork the repository and make your change on a branch.
4. Open a pull request that references the issue number.

More from opensearch-project/sql-cli

• lxml-6.0.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl: 1 vulnerabilities (highest severity is: 7.5) Open
  Mend: dependency security vulnerability

  Difficulty 2/5 1-3 hours Newbie friendliness 58/100

  opensearch-project/sql-cli#65 · Opened May 18, 2026

• requests-2.32.4-py3-none-any.whl: 1 vulnerabilities (highest severity is: 4.4) Open
  Mend: dependency security vulnerability

  Difficulty 2/5 1-3 hours Newbie friendliness 58/100

  opensearch-project/sql-cli#64 · Opened May 18, 2026

• From the author, please Leave a comment or thumb up if you are still using sql-cli, I'm planing to maintain it separately Open

  Difficulty 5/5 Over a week Newbie friendliness 20/100

  opensearch-project/sql-cli#59 · 1 comment · 1 reaction · Opened Apr 7, 2026

• Update version on PyPi Open
  documentation enhancement

  opensearch-project/sql-cli#45 · 3 comments · 1 assignee · Opened Nov 13, 2025

• Github Action Deprecation: actions/upload-artifact@v3 Open

  opensearch-project/sql-cli#31 · 1 comment · 1 assignee · Opened Nov 6, 2024

All issues in opensearch-project/sql-cli

Similar issues

• slack-gif-creator: validate_gif() multiplies the last frame's duration by the frame count, so reported duration/fps are wrong (1.0s GIF reported as 1.8s) Open

  Difficulty 2/5 1-3 hours Newbie friendliness 75/100

  anthropics/skills#1811 · 1 comment · Opened Sep 23, 2026

• App fails to start with gradio 6 (allowed by `gradio>=5.49.1`) Open

  Difficulty 2/5 1-3 hours Newbie friendliness 75/100

  speaches-ai/speaches#678 · Opened Sep 23, 2026

• ModuleNotFoundError: No module named 'mcp.server.fastmcp'. Open
  bug

  Difficulty 2/5 1-3 hours Newbie friendliness 75/100

  datalayer/mcp-compose#42 · Opened Sep 23, 2026

• import spacy fails with ModuleNotFoundError: No module named 'click' Open

  Difficulty 2/5 1-3 hours Newbie friendliness 75/100

  conda-forge/spacy-feedstock#177 · Opened Sep 23, 2026

• humaneval: extract_function_body corrupts a fenced body-only reply, so the same correct code scores INCORRECT fenced and CORRECT unfenced Open

  Difficulty 2/5 1-3 hours Newbie friendliness 70/100

  UKGovernmentBEIS/inspect_evals#2523 · Opened Sep 23, 2026

More Python issues