PT-2026-53325 · Bitnami · Python

Published 2026-06-29 · Updated 2026-06-29

OSV

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Related Identifiers

BIT-PYTHON-2026-0864

Affected Products

Python

References · 9

• https://osv.dev/vulnerability/BIT-python-2026-0864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0864 · Security Note
• https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f · Note
• https://github.com/python/cpython/issues/143927 · Note
• https://github.com/python/cpython/pull/151559 · Note
• https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528 · Note
• https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8 · Note
• https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98 · Note
• https://mail.python.org/archives/list/[e-mail]/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS · Note