requests dependency is pinned to a CVE-2024-47081 affected version

[hamizan-azman]

requests dependency is pinned to a CVE-2024-47081 affected version

Hi, I noticed that the current locked dependency set still includes an affected requests version.

poetry.lock pins:

requests==2.32.3

GHSA-9hjg-9r4m-mvj7 / CVE-2024-47081 affects requests < 2.32.4, so installs from the current lockfile can still use the affected version.

Impact

A crafted URL with userinfo can cause .netrc credentials for the apparent host to be sent to the actual destination controlled by an attacker.

In local validation, running the readmeai CLI with a crafted request path caused a local attacker server to receive an Authorization header. The captured value matched the .netrc credentials configured for the victim host. The credential is redacted below.

[VERIFY] triggered (class=netrc_userinfo_leak): /tmp/attacker.log: Authorization: [REDACTED]

Current evidence

• Current repository HEAD checked: 86edfa13c4d8ac3ce8bc2938c82f4d3d100c064f
• Current lockfile pin: requests==2.32.3
• Advisory fixed version: requests>=2.32.4
• Local validation reached the readmeai CLI path and confirmed the netrc credential leak with redacted Authorization-header evidence.

Suggested fix

Regenerate the lockfile with requests>=2.32.4, or add an explicit lower bound so future installs cannot resolve to the affected version.

Thanks.