i6eal.de
DEEN
Start a project
← Back to the AI Dependency AtlasTime-stamped OSV record dossier

PYSEC-2026-3453

PYSEC-2026-3453
OSV

OSV matched this record to 8 exact package versions observed in 13 public repositories at collection time.

OSVPYSEC-2026-3453OSV record + exact package@version + check time

An OSV match to an exact observed version does not prove reachability, exploitability, deployment or an unmitigated risk.

OSV record + exact package@version + check time
13repositories
1matched package
8exact versions
15exact evidence rows
19 Jul 2026OSV checked
Exact published evidence

Exact package versions submitted to OSV

Each tuple below was observed in a public file. The OSV response is retained separately with its own collection time.

Observed relations

Repositories carrying a matched version

SmartPlanAI Anwendungsh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung
pypi:pillow11.3.0 · 12.1.1
→
strahlenexpositionuba-ki-lab/strahlenexposition
pypi:pillow11.2.1
→
AIiqsh/collaboration-online-board/ai
pypi:pillow10.3.0
→
Coding Agent Usage Simulationuba-ki-lab/coding-agent-usage-simulation
pypi:pillow12.0.0
→
density-mapsuba-ki-lab/density-maps
pypi:pillow12.1.1
→
Energieautarkes Wohnquartier - Backendenergieautarkes-wohnquartier/backend
pypi:pillow11.2.1
→
GSA Extractionuba-ki-lab/gsa-extraction
pypi:pillow11.3.0
→
LLM Questionnaire Benchmarking Frameworkuba-ki-lab/llm-questionnaire-benchmarking-framework
pypi:pillow11.3.0
→
LLM Testframeworkuba-ki-lab/llm-testframework
pypi:pillow11.2.1
→
Objection managementuba-ki-lab/objection-management
pypi:pillow11.1.0
→
photovoltaic_systemsuba-ki-lab/photovoltaic_systems
pypi:pillow11.2.1
→
Ressource Efficient Computer Visionuba-ki-lab/ressource-efficient-computer-vision
pypi:pillow12.1.0
→
Retrieval Evaluationuba-ki-lab/retrieval-evaluation
pypi:pillow10.4.0
→
Exact published evidence

exact evidence rows

AIiqsh/collaboration-online-board/ai
pypi:pillow@10.3.0SPDX_v2.0.0.yml
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Retrieval Evaluationuba-ki-lab/retrieval-evaluation
pypi:pillow@10.4.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Objection managementuba-ki-lab/objection-management
pypi:pillow@11.1.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Energieautarkes Wohnquartier - Backendenergieautarkes-wohnquartier/backend
pypi:pillow@11.2.1poetry.lock
declaration relationship not reportednot marked as development-only
Open exact source ↗
LLM Testframeworkuba-ki-lab/llm-testframework
pypi:pillow@11.2.1uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
photovoltaic_systemsuba-ki-lab/photovoltaic_systems
pypi:pillow@11.2.1sbom.json
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
strahlenexpositionuba-ki-lab/strahlenexposition
pypi:pillow@11.2.1poetry.lock
declaration relationship not reportednot marked as development-only
Open exact source ↗
strahlenexpositionuba-ki-lab/strahlenexposition
pypi:pillow@11.2.1sbom.json
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
GSA Extractionuba-ki-lab/gsa-extraction
pypi:pillow@11.3.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
LLM Questionnaire Benchmarking Frameworkuba-ki-lab/llm-questionnaire-benchmarking-framework
pypi:pillow@11.3.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
SmartPlanAI Anwendungsh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung
pypi:pillow@11.3.0blp_streamlit_pipeline/src/ext/streamlit-draw-image-mask/poetry.lock
declaration relationship not reportednot marked as development-only
Open exact source ↗
Coding Agent Usage Simulationuba-ki-lab/coding-agent-usage-simulation
pypi:pillow@12.0.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Ressource Efficient Computer Visionuba-ki-lab/ressource-efficient-computer-vision
pypi:pillow@12.1.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
density-mapsuba-ki-lab/density-maps
pypi:pillow@12.1.1uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
SmartPlanAI Anwendungsh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung
pypi:pillow@12.1.1poetry.lock
declaration relationship not reportednot marked as development-only
Open exact source ↗
OSV

Published OSV references

ADVISORYhttps://github.com/python-pillow/Pillow/releases/tag/12.3.0FIXhttps://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721FIXhttps://github.com/python-pillow/Pillow/pull/9715EVIDENCEhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6
Interpretation boundary

Exact identities in, explicit limits out

The OSV query uses the exact observed package and version. No returned record is not a safety statement, and a returned record is not an exploitability finding.

Retrieval, parsing, matching and publishing use no generative AI model.

i6eal (2026): PYSEC-2026-3453 — exact AI dependency evidence dossier, data state 19 Jul 2026. https://i6eal.de/en/tools/ki-abhaengigkeitsatlas/schwachstelle/pysec-2026-3453-83974725/

Reading this dossier

Does this record prove an exploitable vulnerability?
No. It documents a time-stamped OSV match to an exact observed version. Reachability, exploitability and deployment are outside the claim.
Why are exact versions required?
OSV and registry metadata can be linked reproducibly only to an observed package@version tuple. The collector never substitutes a newest release for a range.
Does a missing row mean the dependency is absent?
No. It means not observed within the bounded files and repository checkpoint. Incomplete trees and parser failures remain explicit.

Need a permanent dependency evidence trail for another public code cohort?

We build source-backed data products with stable identities, reproducible joins and boundaries that remain visible.

Discuss a data projectExplore all tools
Related tools

Useful next steps

These tools complement the current result.

View all tools
MonitorGerman public-sector AI Code RadarWhich AI building blocks does German public administration publish as open code? Exact packages, containers, commit SHAs and file paths from openCode, with permanent dossiers and no deployment claim.MonitorGerman public-sector AI registerWhere does German public administration already use AI? Search published system profiles from federal, state and municipal bodies, with lifecycle, governance fields, stable identifiers and original evidence.Provenance checkPublic-sector AI system passportSee which public records can be linked to each published government AI system through stable identifiers or exact source-declared repository URLs—with a source for every edge and visible evidence boundaries.