{"id":"GHSA-687h-86vc-5x59","aliases":["CVE-2022-31573","PYSEC-2026-309"],"title":"ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function","description":"The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.","severity":"critical","score":9.3,"published":"2022-07-12T00:00:58.000Z","modified":"2026-10-27T16:30:06.473Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"chainerrl-visualizer","ranges":[{"events":[{"introduced":"0"},{"last_affected":"0.1.1"}],"type":"ECOSYSTEM"}],"versions":["0.1.0","0.1.1"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-31573","https://github.com/github/securitylab/issues/669#issuecomment-1117265726","https://github.com/chainer/chainerrl-visualizer","https://github.com/pypa/advisory-database/tree/main/vulns/chainerrl-visualizer/PYSEC-2026-309.yaml","https://pypi.org/project/chainerrl-visualizer"],"sources":[{"name":"OSV","id":"GHSA-687h-86vc-5x59","modified":"2026-10-27T16:30:06.473986397Z","url":"https://osv.dev/vulnerability/GHSA-687h-86vc-5x59"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","score":9.3}]}