CVE-2023-23608

Advisory

Spotipy 2.22.1 includes a fix for CVE-2023-23608: Path traversal vulnerability that may lead to type confusion in URI handling code.
https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added

- Add alternative module installation instruction to README
- Added Comment to README - Getting Started for user to add URI to app in Spotify Developer Dashboard.
- Added playlist_add_tracks.py to example folder

Changed

- Modified docstring for playlist_add_items() to accept "only URIs or URLs",
with intended deprecation for IDs in v3

Fixed

- Path traversal vulnerability that may lead to type confusion in URI handling code
- Update contributing.md

Resources

• https://pypi.org/project/spotipy
• https://pyup.io/changelogs/spotipy/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23608
• https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v