CVE-2014-1938: Link Following in rply
Summary
CVE-2014-1938: Link Following in rply. Affects rply versions < 0.7.4. Fixed in 0.7.4. How to fix ↓
Also tracked for
- python-rply · Debian:11
The same CVE-2014-1938 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rply package is a Python library that provides a simple yet efficient way to implement lexers and parsers. It is commonly used in various applications for parsing and processing structured data. However, versions before 0.7.4 of rply are vulnerable to a security issue related to insecure creation of temporary files.
Vulnerability Detail
The vulnerability in rply arises from the insecure creation of temporary files. This can potentially allow an attacker to perform a link following attack, where a symbolic link is created to a sensitive file, leading to unauthorized access or modification of that file. The impact of this vulnerability can vary depending on the context in which rply is used, but it has the potential to result in data breaches, unauthorized access, or even remote code execution.
How To Fix
Latest published version: 0.7.8 as of 22 Oct 2026
pip install --upgrade "rply==0.7.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.4
This is the first release that contains the fix.
pip install --upgrade "rply==0.7.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the rply package before version 0.7.4 is vulnerable to a link following attack due to insecure temporary file creation. It is crucial to upgrade to the latest version to mitigate the risk of unauthorized access or data breaches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rply →
FAQ
rply is a Python library used for implementing lexers and parsers in various applications.
The vulnerability can potentially lead to unauthorized access, data breaches, or remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability.
Yes, upgrading to version 0.7.4 or later of rply fixes this vulnerability.
There are no known exploits for this vulnerability at the moment.
References
Related vulnerabilities
Recent vulnerabilities recorded for rply.
