Malicious Code Vulnerability in tabletes Package
Summary
MAL-2026-490: Malicious code in tabletes (PyPI). Affects tabletes versions 1.0.4 – 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tabletes package, available on PyPI, is designed for various functionalities related to text processing and spell checking. However, it has been found to contain hidden malicious code that executes upon import, posing significant security risks to users. This vulnerability allows unauthorized remote code execution, making it critical for users to be aware of its implications.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2025-11-spellcheckers'. The package includes obfuscated code that downloads and executes a second-stage script from a remote server. This script can run background processes that connect to a remote host, waiting for further commands to execute on the victim's machine. The malicious activities include potential data theft and unauthorized command execution, severely compromising user security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tabletesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the tabletes package until it has been updated. Alternatively, consider using other text processing libraries that do not have known vulnerabilities.
Conclusion
The tabletes package has been identified as containing malicious code that poses significant security risks. Users are urged to update to the latest version to protect against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tabletes →
FAQ
The vulnerability involves malicious code that executes upon importing the package, allowing unauthorized remote code execution.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
You should immediately update the package to the latest version using 'pip install --upgrade tabletes' to mitigate the risk.
Yes, the malicious code can download additional scripts and execute commands on the victim's machine, potentially leading to data theft.
Failing to address this vulnerability can lead to unauthorized access to your system, data breaches, and other security incidents.
