PT-2026-51575 · Python · Cpython

D0N9 + 2 · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-0864

NVD

CVSS v4.0

4.1

Medium

Base vector

AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-0864

Affected Products

Cpython

References · 5

• https://github.com/python/cpython/pull/151559 · Patch
• https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-0864 · Security Note
• https://mail.python.org/archives/list/[e-mail]/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS · Vendor Advisory
• https://github.com/python/cpython/issues/143927 · Note