This week's "node2shell" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of Brotli aikido.dev

Aikido Security reports that CVE-2026-111497, the critical “node2shell” flaw in Google’s Brotli decoder, also affects Python packages Brotli 1.2.0 and earlier and brotlicffi 1.2.0.x, as well as other software using the decoder. Crafted compressed data can trigger memory corruption, potentially enabling data leaks, crashes or code execution; fixes include Brotli 1.2.1, Brotli for Python 1.2.1, and brotlicffi 1.2.1.0.