Malicious Code Vulnerability in tabletas Package
Summary
MAL-2026-548: Malicious code in tabletas (PyPI). Affects tabletas versions 1.0.1 – 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tabletas package, available on PyPI, is designed for various functionalities related to text processing and spell checking. However, it has been found to contain hidden malicious code that executes upon import, posing significant security risks to users. This vulnerability allows unauthorized access and control over the victim's machine.
Vulnerability Detail
The vulnerability originates from the package's hidden code, which is executed during the import process. This code downloads additional malicious scripts and establishes a background process that connects to remote hosts, waiting for further commands. The malicious intent is clear, as it includes obfuscation techniques and the ability to execute remote commands on the victim's machine, potentially leading to data theft or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tabletasIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the tabletas package until a patch is confirmed. Additionally, consider using alternative packages that provide similar functionalities without known vulnerabilities.
Conclusion
The tabletas package has been identified as containing malicious code that poses serious security risks. Users are advised to update to the latest version immediately and consider alternative solutions in the meantime. Regular monitoring of open-source vulnerabilities is crucial for maintaining software security.
See every vulnerability recorded for tabletas →
FAQ
The tabletas package is a Python library available on PyPI, primarily used for text processing and spell checking.
The vulnerability allows malicious code to run on your system, potentially leading to unauthorized access, data theft, or control over your machine.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update the package, avoid using it and consider alternative libraries that do not have known vulnerabilities.
More information can be found on the GitHub repository for malicious packages or by monitoring updates from security advisories.
