Exposure of Sensitive Information Affecting zpdatafetch package, versions [,1.2.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Exposure of Sensitive Information vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-ZPDATAFETCH-13834752
- published5 Nov 2025
- disclosed1 Nov 2025
- creditUnknown
Introduced: 1 Nov 2025
New CVE NOT AVAILABLE CWE-117 (opens in a new tab)How to fix?
Upgrade zpdatafetch to version 1.2.0 or higher.
Overview
zpdatafetch is an A package for fetching data from Zwiftpower and Zwiftracing.app
Affected versions of this package are vulnerable to Exposure of Sensitive Information via several improper security practices, including logging of credentials in stdout, a lack of certificated validation, and a lack of input validation. An attacker can obtain username and password through console output or log files, or by leveraging man-in-the-middle attacks, possible due to missing certificate validation.