Skip to main content

Python configparser CVE-2026-0864

| EUVDEUVD-2026-38554 MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2026-06-23 PSF GHSA-g345-7jg6-m22p
Code Injection Cpython Python Software Foundation
4.1
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker controls application input value
  2. Delivery
    Application passes \r-containing string to configparser.write()
  3. Exploit
    CR character terminates value line in config file
  4. Execution
    Injected key=value pair written as standalone config entry
  5. Persist
    Application re-reads config and processes unexpected entries
  6. Impact
    Security-relevant setting overridden by injected value

Vulnerability Assessment

Weakness
CWE
CWE-74
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
Exploitation Conditions

Exploitation requires three concurrent conditions: (1) the attacker controls a string value that a Python application writes to a config file using configparser.write() - for example, through a user-supplied profile field, API request body, or any application input persisted to an INI-style config; (2) the application runs with sufficient privilege for the attacker's data to reach the write path (CVSS PR:H); and (3) the application subsequently re-reads the tampered config file in a security-relevant context. Limiting factors: the attack vector is strictly local (AV:L), a specific attack condition must be present (AT:P), high privileges are required (PR:H), and passive user interaction is needed (UI:P). Default Python installations and applications that do not write attacker-influenced data to configparser-managed files are not affected.
Impact

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) places this at 4.1 Medium. Real-world risk is substantially constrained by the exploitation path: the attacker must already be able to influence the string value an application passes to configparser.write(), which typically implies an application-level data-injection vector that itself requires privilege. AT:P confirms a specific attack condition must be present. The integrity impact is scoped entirely to the config file contents - downstream harm depends on whether the application acts on the injected entries in a security-relevant way (e.g., overriding an allow-list or privilege flag). No EPSS score was supplied; the absence of KEV listing and any known public exploit makes opportunistic mass exploitation very unlikely. This vulnerability is best treated as a defense-in-depth correctness issue for applications that process untrusted input and persist it via configparser, not a high-urgency emergency patch.
Exploit ScenarioDerived

An attacker submits a crafted profile field - for example, a user-supplied description or comment - containing an embedded \r character followed by a new key-value pair such as \radmin=true. An application that persists this field via configparser.write() writes the injected entry as an apparent standalone configuration key; on the next config file read, the application treats admin=true as a legitimate setting and elevates the attacker's privileges. No public proof-of-concept code has been identified at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 23, 2026

Config file injection in CPython's configparser module allows an attacker who controls multi-line values written via configparser.write() to smuggle arbitrary keys and values into the resulting INI-style configuration file by embedding carriage return (\r) characters. All CPython versions are listed as affected per the NVD CPE wildcard, and any Python application that writes attacker-influenced data to config files via configparser is a candidate target. No public exploit has been identified at time of analysis; CVSS 4.0 scores this at 4.1 (Medium) with high privilege requirements and specific attack conditions.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - monitor the PSF security announcement at https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/ for an official tagged CPython release. As a compensating control until a patched release is confirmed, applications should sanitize attacker-influenced strings before passing them to configparser.write() by stripping or replacing carriage return characters (e.g., value.replace('\r', '')) prior to any configparser write operation. Alternatively, avoid writing attacker-controlled strings as multi-line configparser values entirely and substitute a stricter serialization format such as JSON for untrusted data sources. These mitigations carry no meaningful side effects beyond rejecting malformed carriage-return-embedded values.

Affected VersionsENISA

CPython 0 <3.15.0

Affected Packages

euvd cpython fix: 3.15.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Python configparser module (cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*) reads and writes Windows INI-style configuration files where multi-line values are represented by indented continuation lines. When configparser serializes values containing bare carriage return characters (\r, U+000D), it does not strip or encode them before writing. Since \r alone can act as a line terminator in some parsers and on some platforms, an attacker-controlled value embedding \r followed by a key=value string causes that pair to appear as a legitimate top-level configuration entry when the file is subsequently read. This is a variant of CRLF/CR injection - tagged as Code Injection in the source intelligence - arising from the absence of output-encoding on the write path. No CWE was provided in the input data; the closest applicable class is CWE-93 (Improper Neutralization of CRLF Sequences) or CWE-74 (Injection).

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 4.1 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
vuln.today AI 4.0 MEDIUM

Local vector and high complexity reflect the required attack conditions; PR:H and UI:R map from CVSS 4.0 PR:H and UI:P; integrity-only impact with no confidentiality or availability effect.

3.1 AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat 5.5 MEDIUM

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
High
User Interaction
Passive
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
High
CPython is the dominant Python runtime, widely deployed across enterprise and cloud
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

20
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +20
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

CVE-2026-19672 MEDIUM
6.3 Aug 19

CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
PATCH https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f PATCH https://github.com/python/cpython/pull/151559 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-0864 ADVISORY https://vuldb.com/vuln/373013 REF https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528 REF https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd REF https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908 REF https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98 REF https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8 REF https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6 REF https://github.com/python/cpython/issues/143927

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy