CVE-2026-0864

Published: Jun 23, 2026Modified: Jun 25, 2026

4.1

Vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Related CWEs

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (7)

https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528

Source: cna@python.org

https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f

Source: cna@python.org

https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98

Source: cna@python.org

https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8

Source: cna@python.org

https://github.com/python/cpython/issues/143927

Source: cna@python.org

https://github.com/python/cpython/pull/151559

Source: cna@python.org

https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/

Source: cna@python.org

Timeline

No history available yet.