Malicious Code Vulnerability in tessivatts Package - Remote Script Execution Risk
Summary
MAL-2026-18148: Malicious code in tessivatts (PyPI). Affects tessivatts versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tessivatts package, available on PyPI, is designed for voice synthesis profiles. It allows users to integrate voice synthesis capabilities into their applications. However, the package has been identified as part of a coordinated campaign that includes loader packages capable of executing code from remote URLs, raising significant security concerns.
Vulnerability Detail
The vulnerability in the tessivatts package stems from its ability to download and execute remote scripts, which can lead to the execution of malicious code on the user's system. This vulnerability is part of a broader campaign identified as '2026-10-voice-synthesis-profiles', which aims to distribute malicious payloads through deceptive packages. The specific version affected is 0.1.0, and the malicious code is executed without user consent, potentially leading to data theft or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tessivattsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the tessivatts package until a secure version is released. If you must use it, consider implementing network security measures to block unauthorized script execution from external URLs.
Conclusion
The tessivatts package has been identified as having a serious vulnerability that allows for the execution of remote malicious scripts. Users are advised to update the package as soon as a patched version is available and to consider using security measures to mitigate risks in the meantime.
See every vulnerability recorded for tessivatts →
FAQ
The tessivatts package is a Python library for integrating voice synthesis capabilities into applications, allowing developers to create applications that can generate spoken audio.
The vulnerability allows the tessivatts package to download and execute remote scripts, which can lead to the execution of malicious code on the user's system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you are using version 0.1.0 of the tessivatts package, it is recommended to stop using it and update to a patched version as soon as it is available.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock, providing a hassle-free way to stay informed about potential security risks.
