2026-10-22 18:03 UTC
horses was last released in 2024, and can only run on python up to 3.12.
horses depends on iron-making, that is up to date. That means the current version of iron-making depends on python >= 3.14, and that all the versions prior to 2025 were taken offline due to a CVE where if you run the library as root in a web backend that uses the make_nail function, people can open your barn doors without authorization when inside it.
Replies (4)
-
@anewfox@lemmy.zip 2026-10-22 18:22
and also the most recent horses release on pypi includes a crypto miner and credential stealer.
-
@thebardingreen@lemmy.starlightkel.xyz 2026-10-22 18:30
I cannot up vote this enough.
-
@yxc999@lemmy.ml 2026-10-22 21:11
thanks, I hate it
-
@nibbler@discuss.tchncs.de 2026-10-23 22:28
I’m really having trouble recognizing if @marcos@lemmy.world started talking bullhoreseshit, or if the post by @Diplomjodler@lemmy.world is the first to be just trolling…