Apprise vulnerable to regex injection with IFTTT Plugin
Impact
Anyone publicly hosting the Apprise library and granting them access to the IFTTT notification service.
Patches
Update to Apprise v0.9.5.1
# Install Apprise v0.9.5.1 from PyPI
pip install apprise==0.9.5.1The patch to the problem was performed here.
Workarounds
Alternatively, if upgrading is not an option, you can safely remove the following file:
apprise/plugins/NotifyIFTTT.py
The above will eliminate the ability to use IFTTT, but everything else will work smoothly.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Apprise
- Email me at lead2gold@gmail.com
Additional Credit
Github would not allow me to additionally credit Rasmus Petersen, but I would like to put that here at the very least - thank you for finding and reporting this issue along with those already credited
Additional Notes:
- Github would not allow me to add/tag the 2 CWE's this issue is applicable to (only CWE-400). The other is: CWE-730 (placed in the title)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | apprise | < 0.9.5.1 | 0.9.5.1 |
References
- https://github.com/caronc/apprise/security/advisories/GHSA-qhmp-h54x-38qr
- https://github.com/caronc/apprise/pull/436
- https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359
- https://nvd.nist.gov/vuln/detail/CVE-2021-39229
- https://github.com/caronc/apprise/commit/e20fce630d55e4ca9b0a1e325a5fea6997489831
- https://github.com/caronc/apprise
- https://github.com/caronc/apprise/releases/tag/v0.9.5.1
- https://github.com/pypa/advisory-database/tree/main/vulns/apprise/PYSEC-2021-327.yaml
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-400- Platform
- Python (PyPI)
- Package
apprise- Disclosed
- 20.09.2021
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2021-327 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-qhmp-h54x-38qr - CC BY 4.0
Vulnerability history: apprise
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 09.2021 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Low 1
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
Apprise vulnerable to regex injection with IFTTT Plugin this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.