Vulnerabilities for spotipy

First version without a known vulnerability: 2.25.2

Details

• GHSA-r77h-rpp9-w2xm2025-12-01

  Spotipy has a XSS vulnerability in its OAuth callback server

  Fixed in: 2.25.2

• GHSA-pwhh-q4h6-w5992025-02-28

  Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

  Fixed in: 2.25.1

• GHSA-q764-g6fm-555v2023-01-23

  Path traversal in spotipy

  Fixed in: 2.22.1