Homepage

Incorrect Default Permissions Affecting spotipy package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Incorrect Default Permissions vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIANUNSTABLE-SPOTIPY-9055233
  • published2 Mar 2025
  • disclosed27 Feb 2025
Report a new vulnerability Found a mistake?

Introduced: 27 Feb 2025

NewCVE-2025-27154  (opens in a new tab)
CWE-276  (opens in a new tab)

How to fix?

There is no fixed version for Debian:unstable spotipy.

NVD Description

Note: Versions mentioned in the description apply only to the upstream spotipy package and not the spotipy package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- (644) permissions by default, when it could be locked down to rw------- (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.