How do I check whether I am affected by CVE-2022-31573?

- Run `pip show chainerrl-visualizer` and compare the installed version to the affected range (<= `0.1.1`) - Check whether the visualizer web endpoints are reachable from untrusted networks

What is the fix for CVE-2022-31573?

- Upgrade `chainerrl-visualizer` past `0.1.1`; the fixed version is unknown from the sources - If no fixed release exists, remove or restrict access to the visualizer service until patched

Who is not affected by CVE-2022-31573?

Not affected if: no-public-exposure, not-installed.

Live › vulnerability › CVE-2022-31573

Go to dashboard

critical9.3Packagepypi

ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function

Q: What is the fix for CVE-2022-31573?

- Upgrade `chainerrl-visualizer` past `0.1.1`; the fixed version is unknown from the sources - If no fixed release exists, remove or restrict access to the visualizer service until patched

Q: Who is not affected by CVE-2022-31573?

Not affected if: no-public-exposure, not-installed.

ChainerRL Visualizer 0.1.1 and earlier passes user-supplied paths to Flask's send_file without validation, allowing absolute path traversal. A remote attacker can read arbitrary files the server process can access.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by GitHub

known so far6 of 6

First public: Jul 11, 2022 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 1.4% in 30d

First seen by InfraStack 2026-10-27 16:20 UTC, 0h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker reads arbitrary files from the server filesystem.
CVSS said: 9.3. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2022-31573

Go to dashboard

critical9.3Packagepypi

ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by GitHub

known so far6 of 6

First public: Jul 11, 2022 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 1.4% in 30d

First seen by InfraStack 2026-10-27 16:20 UTC, 0h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker reads arbitrary files from the server filesystem.
CVSS said: 9.3. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
chainerrl-visualizer	pypi	<= 0.1.1	–
chainer chainerrl-visualizer	vendor	<= 0.1.1	–

ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources