From 0049d862c21328e283f71e9ef4e4a147e77cd24f Mon Sep 17 00:00:00 2001
From: Wang ChengMeng <79295644+cmw-creator@users.noreply.github.com>
Date: Thu, 4 Jun 2026 20:24:44 +0800
Subject: [PATCH] fix: gracefully handle invalid specifiers in vulnerability DB
 (#873)

---
 safety/scan/ecosystems/python/main.py | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/safety/scan/ecosystems/python/main.py b/safety/scan/ecosystems/python/main.py
index 12d2af45..54cd23e4 100644
--- a/safety/scan/ecosystems/python/main.py
+++ b/safety/scan/ecosystems/python/main.py
@@ -38,7 +38,7 @@
 
 from packaging.version import parse as parse_version
 from packaging.utils import canonicalize_name
-from packaging.specifiers import SpecifierSet
+from packaging.specifiers import InvalidSpecifier, SpecifierSet
 
 
 LOG = logging.getLogger(__name__)
@@ -338,7 +338,14 @@ def __find_dependency_vulnerabilities__(
             if name in vulnerable_packages:
                 # we have a candidate here, build the spec set
                 for specifier in db["vulnerable_packages"][name]:
-                    spec_set = SpecifierSet(specifiers=specifier)
+                    try:
+                        spec_set = SpecifierSet(specifiers=specifier)
+                    except InvalidSpecifier:
+                        LOG.warning(
+                            "Skipping invalid specifier '%s' for package '%s'",
+                            specifier, name
+                        )
+                        continue
 
                     if spec.is_vulnerable(spec_set, dependency.insecure_versions):
                         if not db_full: