Skip to content
Tools / chatgpt-on-wechat / Security

Security Deep Dive

chatgpt-on-wechat

Security posture and CVE patch evidence from tracked releases.

Back to Tool

1 actively-exploited dependency CVE affects 2.1.0.

KEV-listed CVEs are confirmed exploited in the wild — patch urgently.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

11 versions tracked
Version Published C H M L KEV Notes
2.1.0 2026-06-01 — — — — —
Latest
2.0.9 2026-05-22 — — — — —
Patches CVE-2023-4863
2.0.8 2026-05-06 — 1 — — KEV 1
—
2.0.7 2026-04-23 — 1 — — KEV 1
—
2.0.6 2026-04-14 — 1 — — KEV 1
—
2.0.5 2026-04-01 — 1 — — KEV 1
—
2.0.4 2026-03-22 — 1 — — KEV 1
—
2.0.3 2026-03-18 — 1 — — KEV 1
—
2.0.2 2026-02-27 — 1 — — KEV 1
—
2.0.1 2026-02-13 — 1 — — KEV 1
—
2.0.0 2026-02-03 — 1 — — KEV 1
—
— Signed — SLSA — SBOM ✗ Security policy Weekly cadence · 11d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
—
SLSA provenance Unknown
Attestation predicate level Latest release
—
SBOM published Unknown
GitHub SBOM API Latest release
—
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 23d ago
Release cadence: weekly Present
11d median over recent releases Release history
Latest release: 2d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 1d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 2d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 2d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 2d ago
0.5/10 Security Score
Dependency Exposure 147 transitive dependency CVEs found in the latest SBOM. 17 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.00 / 0.5

Max EPSS 0.933

freshness

1.00 / 1.0

1d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

0.00 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

-1.50 / 1.5

KEV exposure detected

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 17c/51h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 1d

Operational risk

operational risk

0.0

10%

kev exposure: detected epss max: 0.933
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
17 Transitive critical CVEs
1 KEV-transitive CVEs
67% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

CVE Patch History

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low
2026
1
CVE Severity EPSS Disclosed Fixed in Days to fix vs Ecosystem Median KEV
CVE-2023-4863 HIGH 99%ile — 2.0.9 — — KEV

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

49 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

17

High

51

Medium

59

Low

17

Unknown

3

1 dependency vulnerabilities are in KEV.

CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.

Still affecting latest (0) All (147)
Critical 17 High 51 Medium 59 Low 17 Unknown 3
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2014-3007 critical — pillow — 2.0.9
CVE-2014-9706 critical — dulwich — 2.0.9
CVE-2015-0838 critical — dulwich — 2.0.9
CVE-2016-4009 critical — pillow — 2.0.9
CVE-2017-16228 critical — dulwich — 2.0.9
CVE-2017-18342 critical — pyyaml — 2.0.9
CVE-2019-20477 critical — pyyaml — 2.0.9
CVE-2020-11538 critical — pillow — 2.0.9
CVE-2020-14343 critical — pyyaml — 2.0.9
CVE-2020-1747 critical — pyyaml — 2.0.9
CVE-2020-5310 critical — pillow — 2.0.9
CVE-2020-5311 critical — pillow — 2.0.9
CVE-2020-5312 critical — pillow — 2.0.9
CVE-2021-25289 critical — pillow — 2.0.9
CVE-2021-34552 critical — pillow — 2.0.9
CVE-2022-22817 critical — pillow — 2.0.9
CVE-2023-50447 critical — pillow — 2.0.9
CVE-2013-1633 high — setuptools — 2.0.9
CVE-2014-1932 high — pillow — 2.0.9
CVE-2014-3589 high — pillow — 2.0.9
CVE-2014-3598 high — pillow — 2.0.9
CVE-2014-9601 high — pillow — 2.0.9
CVE-2016-0775 high — pillow — 2.0.9
CVE-2016-2533 high — pillow — 2.0.9
CVE-2016-3076 high — pillow — 2.0.9
CVE-2016-5851 high — python-docx — 2.0.9
CVE-2016-9190 high — pillow — 2.0.9
CVE-2018-15560 high — pycryptodome — 2.0.9
CVE-2018-18074 high — requests — 2.0.9
CVE-2019-16865 high — pillow — 2.0.9
CVE-2019-19911 high — pillow — 2.0.9
CVE-2020-10177 high — pillow — 2.0.9
CVE-2020-10378 high — pillow — 2.0.9
CVE-2020-10379 high — pillow — 2.0.9
CVE-2020-10994 high — pillow — 2.0.9
CVE-2020-35653 high — pillow — 2.0.9
CVE-2020-35654 high — pillow — 2.0.9
CVE-2020-5313 high — pillow — 2.0.9
CVE-2021-23437 high — pillow — 2.0.9
CVE-2021-25287 high — pillow — 2.0.9
CVE-2021-25288 high — pillow — 2.0.9
CVE-2021-25290 high — pillow — 2.0.9
CVE-2021-25291 high — pillow — 2.0.9
CVE-2021-25293 high — pillow — 2.0.9
CVE-2021-27921 high — pillow — 2.0.9
CVE-2021-27922 high — pillow — 2.0.9
CVE-2021-27923 high — pillow — 2.0.9
CVE-2021-28675 high — pillow — 2.0.9
CVE-2021-28676 high — pillow — 2.0.9
CVE-2021-28677 high — pillow — 2.0.9
CVE-2022-24303 high — pillow — 2.0.9
CVE-2022-30595 high — pillow — 2.0.9
CVE-2022-40897 high — setuptools — 2.0.9
CVE-2022-45198 high — pillow — 2.0.9
CVE-2022-45199 high — pillow — 2.0.9
CVE-2023-44271 high — pillow — 2.0.9
CVE-2023-4863 high KEV pillow — 2.1.0
CVE-2023-52323 high — pycryptodome — 2.0.9
CVE-2024-23334 high — aiohttp — 2.0.9
CVE-2024-28219 high — pillow — 2.0.9
CVE-2024-30251 high — aiohttp — 2.0.9
CVE-2024-6345 high — setuptools — 2.0.9
CVE-2025-47273 high — setuptools — 2.0.9
CVE-2025-48379 high — pillow — 2.0.9
CVE-2025-69223 high — aiohttp — 2.0.9
CVE-2026-25990 high — pillow — 2.0.9
CVE-2026-40192 high — pillow — 2.0.9
CVE-2026-42311 high — pillow — 2.0.9
CVE-2014-1829 medium — requests — 2.0.9
CVE-2014-1830 medium — requests — 2.0.9
CVE-2014-1933 medium — pillow — 2.0.9
CVE-2015-2296 medium — requests — 2.0.9
CVE-2016-0740 medium — pillow — 2.0.9
CVE-2016-9189 medium — pillow — 2.0.9
CVE-2017-5992 medium — openpyxl — 2.0.9
CVE-2020-35655 medium — pillow — 2.0.9
CVE-2021-25292 medium — pillow — 2.0.9
CVE-2021-28678 medium — pillow — 2.0.9
CVE-2022-22815 medium — pillow — 2.0.9
CVE-2022-22816 medium — pillow — 2.0.9
CVE-2023-32681 medium — requests — 2.0.9
CVE-2023-36464 medium — pypdf — 2.0.9
CVE-2023-37276 medium — aiohttp — 2.0.9
CVE-2023-46250 medium — pypdf — 2.0.9
CVE-2023-47627 medium — aiohttp — 2.0.9
CVE-2023-49081 medium — aiohttp — 2.0.9
CVE-2023-49082 medium — aiohttp — 2.0.9
CVE-2024-23829 medium — aiohttp — 2.0.9
CVE-2024-27306 medium — aiohttp — 2.0.9
CVE-2024-35195 medium — requests — 2.0.9
CVE-2024-42367 medium — aiohttp — 2.0.9
CVE-2024-47081 medium — requests — 2.0.9
CVE-2024-52303 medium — aiohttp — 2.0.9
CVE-2024-52304 medium — aiohttp — 2.0.9
CVE-2025-55197 medium — pypdf — 2.0.9
CVE-2025-62707 medium — pypdf — 2.0.9
CVE-2025-62708 medium — pypdf — 2.0.9
CVE-2025-66019 medium — pypdf — 2.0.9
CVE-2025-69227 medium — aiohttp — 2.0.9
CVE-2025-69228 medium — aiohttp — 2.0.9
CVE-2025-69229 medium — aiohttp — 2.0.9
CVE-2026-22815 medium — aiohttp — 2.0.9
CVE-2026-24688 medium — pypdf — 2.0.9
CVE-2026-25645 medium — requests — 2.0.9
CVE-2026-27024 medium — pypdf — 2.0.9
CVE-2026-27025 medium — pypdf — 2.0.9
CVE-2026-27026 medium — pypdf — 2.0.9
CVE-2026-27888 medium — pypdf — 2.0.9
CVE-2026-28351 medium — pypdf — 2.0.9
CVE-2026-28684 medium — python-dotenv — 2.0.9
CVE-2026-28804 medium — pypdf — 2.0.9
CVE-2026-31826 medium — pypdf — 2.0.9
CVE-2026-33123 medium — pypdf — 2.0.9
CVE-2026-33699 medium — pypdf — 2.0.9
CVE-2026-34515 medium — aiohttp — 2.0.9
CVE-2026-34516 medium — aiohttp — 2.0.9
CVE-2026-34525 medium — aiohttp — 2.0.9
CVE-2026-40260 medium — pypdf — 2.0.9
CVE-2026-41168 medium — pypdf — 2.0.9
CVE-2026-41312 medium — pypdf — 2.0.9
CVE-2026-41313 medium — pypdf — 2.0.9
CVE-2026-41314 medium — pypdf — 2.0.9
CVE-2026-42308 medium — pillow — 2.0.9
CVE-2026-42309 medium — pillow — 2.0.9
CVE-2026-42310 medium — pillow — 2.0.9
GHSA-jgpv-4h4c-xhw3 medium — pillow — 2.0.9
GHSA-pjjw-qhg8-p2p9 medium — aiohttp — 2.0.9
CVE-2021-21330 low — aiohttp — 2.0.9
CVE-2023-47641 low — aiohttp — 2.0.9
CVE-2025-53643 low — aiohttp — 2.0.9
CVE-2025-69224 low — aiohttp — 2.0.9
CVE-2025-69225 low — aiohttp — 2.0.9
CVE-2025-69226 low — aiohttp — 2.0.9
CVE-2025-69230 low — aiohttp — 2.0.9
CVE-2026-22690 low — pypdf — 2.0.9
CVE-2026-22691 low — pypdf — 2.0.9
CVE-2026-27628 low — pypdf — 2.0.9
CVE-2026-34513 low — aiohttp — 2.0.9
CVE-2026-34514 low — aiohttp — 2.0.9
CVE-2026-34517 low — aiohttp — 2.0.9
CVE-2026-34518 low — aiohttp — 2.0.9
CVE-2026-34519 low — aiohttp — 2.0.9
CVE-2026-34520 low — aiohttp — 2.0.9
GHSA-4fx9-vc88-q2xc low — pillow — 2.0.9
OSV-2022-1074 unknown — pillow — 2.0.9
OSV-2022-715 unknown — pillow — 2.0.9
PYSEC-2023-175 unknown — pillow — 2.0.9

Showing 147 of 147

Beta — feedback welcome: [email protected]