pypi.vulnerabilities

stable Advanced

Known vulnerabilities of a specific PyPI release (from OSV).

GET /v1/pypi/vulnerabilities

What you get#

A list of PyPI results in Onekey's unified shape, in data (an array). An empty array is a normal, successful answer and is charged like any other; a source that reports "nothing found" as an error returns a free 404 not_found instead.

What it costs#

Advanced · 5 credits for a fresh fetch, charged only when it succeeds.
Free when served from cache (0.2 credit for a cached response over 100 KB).
Free if the request is invalid (never charged) or the source fails or reports not found (refunded).

Parameters#

Name	Type	Required	Default	What it is	Constraints
`name`	string	yes	(required)	PyPI project name, e.g. requests	max 100 chars; must match `[a-z0-9](?:[a-z0-9._-]{0,98}[a-z0-9])?`; trimmed, lowercased
`version`	string	yes	(required)	Exact version, e.g. 2.31.0	max 64 chars; must match `[A-Za-z0-9][A-Za-z0-9._+!-]{0,63}`; trimmed

Request#

curl "https://api.onekey.dev/v1/pypi/vulnerabilities?name=requests&version=2.31.0" \
  -H "x-api-key: YOUR_API_KEY"

Try it

Add your key to run this call right here. No key? Get one free. The key stays in this tab.

Recorded response#

A real PyPI response, recorded and returned in Onekey's shape. Fields the platform does not provide are null.

json

{
  "success": true,
  "data": [
    {
      "content": {
        "id": "GHSA-9wx4-h78v-vm56",
        "title": null,
        "text": "When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.\n\nThis occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.\n\nThis behavior affects versions of `requests` prior to 2.32.0.",
        "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56"
      },
      "ext": {
        "aliases": [
          "CVE-2024-35195",
          "PYSEC-2026-1873"
        ],
        "fixedIn": [
          "2.32.0"
        ]
      }
    },
    {
      "content": {
        "id": "GHSA-9hjg-9r4m-mvj7",
        "title": null,
        "text": "### Impact\n\nDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.\n\n### Workarounds\nFor older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).\n\n### References\nhttps://github.com/psf/requests/pull/6965\nhttps://seclists.org/fulldisclosure/2025/Jun/2",
        "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
      },
      "ext": {
        "aliases": [
          "CVE-2024-47081",
          "PYSEC-2026-1872"
        ],
        "fixedIn": [
          "2.32.4"
        ]
      }
    }
  ],
  "metadata": {
    "platform": "pypi",
    "endpoint": "vulnerabilities",
    "cached": false,
    "stale": false,
    "age_s": 0,
    "fetched_at": "2026-01-01T12:00:00+00:00",
    "credits_charged": 5,
    "request_id": "7f3a9c2e5b1d4c8fa2e6d0b9c4f18e37"
  },
  "error": null
}

Field mapping#

How this endpoint's source fields become Onekey's unified schema. Fields the source lacks come back as null.

Source path	Onekey field	Transform
`id`	`content.id`	-
`summary`	`content.title`	-
`details`	`content.text`	-
`link`	`content.url`	`safeUrl`
`aliases`	`ext.aliases`	-
`fixed_in`	`ext.fixedIn`	-

Caching and freshness#

Fresh for about 2 minutes. Repeat calls in that window are served from cache and are free.
Between 2 minutes and 15 minutes the cached copy is still served instantly and marked stale: true while Onekey refreshes it in the background.
If the source is down when a refresh is needed, the last copy can be served for up to 1 hour more (marked stale).
A "not found" is remembered for 1 minute and is free.
The cache is shared across all customers, which is what keeps repeat calls cheap.

What can go wrong#

Status	Code	What to do
401	`unauthorized`	Check the `x-api-key` header.
402	`insufficient_credits`	Add credits; your balance must cover the price.
404	`not_found`	Unknown endpoint path.
422	`invalid_params`	Fix the parameters using the table above. Free.
429	`rate_limited`	Wait `Retry-After` seconds, then retry.
502	`upstream_error`	The source failed. Refunded; retry with backoff.

See Errors for the full list and retry guidance.

Status: stable (verified against the live source).