Malicious Code Vulnerability in filesystem-python Package
Summary
MAL-2025-6506: Malicious code in filesystem-python (PyPI). Affects filesystem-python versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The filesystem-python package is a Python library designed for file system manipulation, providing developers with tools to interact with files and directories. It is commonly used in applications that require file handling capabilities. However, this package has been identified with a serious vulnerability that exposes users to potential security risks.
Vulnerability Detail
The vulnerability, identified as MAL-2025-6506, originates from malicious code embedded in version 0.0.1 of the filesystem-python package. This code can lead to unauthorized access and manipulation of the file system, posing significant risks to data integrity and security. Users of this package are at risk of exploitation, which could result in data breaches or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall filesystem-pythonIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the filesystem-python package until a secure version is confirmed. Additionally, consider using alternative libraries for file system manipulation that are known to be secure.
Conclusion
The filesystem-python package has a critical vulnerability due to malicious code in version 0.0.1, which can lead to severe security risks. Users are advised to update the package promptly and consider alternative solutions until a secure version is confirmed. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for filesystem-python →
FAQ
filesystem-python is a Python library that allows developers to manipulate files and directories within their applications.
The vulnerability involves malicious code that can compromise the security of the file system, potentially leading to unauthorized access and data manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider using alternative libraries for file system operations and monitor for updates on the filesystem-python package.
The vulnerability was identified by ReversingLabs, a security research firm specializing in malware analysis.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
