GCVE-110-PYPI-2026-008397

Advisory Published

Vulnetix · Advisory published July 2, 2026

[IOC-STIX-MATCH] Malicious domain protonmail.com — referenced in tolokaforge/setup.py — matched: "protonmail.com", "aol.com", "mail.com", "zoho.com", "yandex.com",

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious CodeCWE-94Improper Control of Generation of Code ('Code Injection')CWE-522Insufficiently Protected Credentials

Affected Products

Vendor	Product	Versions	Platforms
pypi	tolokaforge	* (affected), * (affected), * (affected), * (affected)	—

References

advisory

web

Browse GCVE Records

73,734 records in the GCVE database · Updated July 18, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON