Vulnerability in Spotipy-dev Spotipy
CVE-2025-27154
Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could b…
EPSS: 0.002 (46.7th percentile) — read the EPSS interpretation.
Affected products
- Spotipy-dev Spotipy — versions < 2.25.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w599 (x_refsource_CONFIRM)
- https://github.com/spotipy-dev/spotipy/commit/1ca453f6ef87a2a9e9876f52b6cb38d13532ccf2 (x_refsource_MISC)
- https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98 (x_refsource_MISC)
- https://github.com/spotipy-dev/spotipy/releases/tag/2.25.1 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-27154?
- CVE-2025-27154 is a vulnerability in Spotipy-dev Spotipy, classified under Incorrect Default Permissions. Published 2025-02-27.
- Is CVE-2025-27154 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.