Malicious Code Injection in tableates Package: A Critical Security Vulnerability
Summary
MAL-2026-492: Malicious code in tableates (PyPI). Affects tableates versions 1.0.3 – 1.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tableates package, available on PyPI, is designed for text processing and manipulation. It is utilized by developers for various applications requiring spell-checking functionalities. However, recent findings have revealed that this package contains hidden malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2025-11-spellcheckers'. The tableates package includes obfuscated code that executes upon import, downloading additional malicious scripts from remote servers. This code allows unauthorized remote command execution on the victim's machine, potentially leading to data theft or further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tableatesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the tableates package until a secure version is released. Additionally, consider using alternative libraries for text processing that do not have known vulnerabilities.
Conclusion
The tableates package has been identified as containing malicious code that poses serious security risks. Users are urged to update their installations immediately and consider alternative libraries until a secure version is confirmed. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for tableates →
FAQ
The malicious code is designed to run during the import of the package, downloading additional scripts and allowing remote command execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed a vulnerable version of tableates, you should uninstall it and update to the latest patched version immediately.
Yes, the vulnerability allows attackers to execute remote commands on the victim's machine, which can lead to further exploitation.
The impacts include unauthorized access to sensitive data, potential data loss, and the risk of further attacks on the affected system.
