VDB

GCVE-110-OSM-2026-6736

GCVE-110-OSM-2026-6736
Advisory PublishedCVSS 8.8/10
Vulnetix · Advisory published June 27, 2026
Malicious package detected. Behaviors: data exfiltration. ENTRY pdf_converter_pro/__init__.py (module-import: 136) DESTINATION - telegram-bot: 8752946775:AAH7P0kP4Ya0XGBmOG3YKhzxueh2jNRJqo8 (primary, plaintext) in pdf_converter_pro/__init__.py - telegram-bot: api.telegram.org/bot{token}/sendDocument (plaintext) in pdf_converter_pro/__init__.py EXFIL - Data Encoding for Exfiltration in pdf_converter_pro/__init__.py: "base64.b64encode(" PAYLOAD FILES pdf_converter_pro/__init__.py INDICATORS (IOCs) - payloadFileHash: f299bf961b9a8952dcb12ecdae5cdb5c19bc22a03e5abc44632801c92a49f250
Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersionsPlatforms
unknownpdf-converter-proall (affected)—

Aliases

MAL-2026-6541

References

Malicious pypi package: pdf-converter-pro
advisory
advisory
vendor

Browse GCVE Records

73,442 records in the GCVE database · Updated July 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›