PT-2026-51575 · Python · Cpython

D0N9 + 2 · Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-0864

NVD

CVSS v4.0

4.1

Média

Vetor base

AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2026-0864

Produtos afetados

Cpython

Referências · 5

• https://github.com/python/cpython/issues/143927 · Nota
• https://github.com/python/cpython/pull/151559 · Correção
• https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-0864 · Nota de Segurança
• https://mail.python.org/archives/list/[e-mail]/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS · Aviso do Fabricante