CVE-2026-0864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0864", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "state": "PUBLISHED", "assignerShortName": "PSF", "dateReserved": "2026-01-12T16:07:55.453Z", "datePublished": "2026-06-23T17:42:01.947Z", "dateUpdated": "2026-08-13T00:29:03.258Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"version": "0", "lessThan": "3.10.21", "status": "affected", "versionType": "python"}, {"version": "3.11.0", "lessThan": "3.11.16", "status": "affected", "versionType": "python"}, {"version": "3.12.0", "lessThan": "3.12.14", "status": "affected", "versionType": "python"}, {"version": "3.13.0", "lessThan": "3.13.15", "status": "affected", "versionType": "python"}, {"version": "3.14.0", "lessThan": "3.14.7", "status": "affected", "versionType": "python"}, {"version": "3.15.0a1", "lessThan": "3.15.0b4", "status": "affected", "versionType": "python"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "D0n9 (https://github.com/D0n9)"}, {"lang": "en", "type": "remediation reviewer", "value": "Petr Viktorin (https://github.com/encukou)"}, {"lang": "en", "type": "coordinator", "value": "Seth Larson (https://github.com/sethmlarson)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"type": "text/html", "value": "When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value."}], "value": "When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 4.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-08-13T00:29:03.258Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/python/cpython/pull/151559"}, {"tags": ["vendor-advisory"], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/"}, {"tags": ["issue-tracking"], "url": "https://github.com/python/cpython/issues/143927"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908"}], "source": {"discovery": "UNKNOWN"}, "title": "Configuration Injection via Carriage Return (\\r) in write() method", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T18:34:23.504725Z", "id": "CVE-2026-0864", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T18:34:49.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T18:34:23.504725Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T18:34:40.390Z"}}], "cna": {"title": "Configuration Injection via Carriage Return (\\r) in write() method", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "D0n9 (https://github.com/D0n9)"}, {"lang": "en", "type": "remediation reviewer", "value": "Petr Viktorin (https://github.com/encukou)"}, {"lang": "en", "type": "coordinator", "value": "Seth Larson (https://github.com/sethmlarson)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "product": "CPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.21", "versionType": "python"}, {"status": "affected", "version": "3.11.0", "lessThan": "3.11.16", "versionType": "python"}, {"status": "affected", "version": "3.12.0", "lessThan": "3.12.14", "versionType": "python"}, {"status": "affected", "version": "3.13.0", "lessThan": "3.13.15", "versionType": "python"}, {"status": "affected", "version": "3.14.0", "lessThan": "3.14.7", "versionType": "python"}, {"status": "affected", "version": "3.15.0a1", "lessThan": "3.15.0b4", "versionType": "python"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/python/cpython/pull/151559", "tags": ["patch"]}, {"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/python/cpython/issues/143927", "tags": ["issue-tracking"]}, {"url": "https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value.", "supportingMedia": [{"type": "text/html", "value": "When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value."}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-08-13T00:29:03.258Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0864", "state": "PUBLISHED", "dateUpdated": "2026-08-13T00:29:03.258Z", "dateReserved": "2026-01-12T16:07:55.453Z", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "datePublished": "2026-06-23T17:42:01.947Z", "assignerShortName": "PSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"lessThan": "3.10.21", "status": "affected", "version": "0", "versionType": "python"}, {"lessThan": "3.11.16", "status": "affected", "version": "3.11.0", "versionType": "python"}, {"lessThan": "3.12.14", "status": "affected", "version": "3.12.0", "versionType": "python"}, {"lessThan": "3.13.15", "status": "affected", "version": "3.13.0", "versionType": "python"}, {"lessThan": "3.14.7", "status": "affected", "version": "3.14.0", "versionType": "python"}, {"lessThan": "3.15.0b4", "status": "affected", "version": "3.15.0a1", "versionType": "python"}]}], "source": "cna@python.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "35C0374F-6CC2-4546-8933-B382CD3A9225", "versionEndExcluding": "3.10.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "D409E2A6-22F1-47D5-A273-4772BF45925E", "versionEndExcluding": "3.11.16", "versionStartIncluding": "3.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "15B3E361-E948-4A55-A163-E681B8E0EF16", "versionEndExcluding": "3.12.14", "versionStartIncluding": "3.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "7DBD3E4F-47FF-48C4-8A44-D2EC2AF84E3C", "versionEndExcluding": "3.13.15", "versionStartIncluding": "3.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "4EA7DE57-F5C8-4AD0-A8A8-5E9C3FC75310", "versionEndExcluding": "3.14.7", "versionStartIncluding": "3.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "A3327507-0B1D-4F28-A983-D07A2C8A7696", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "C8AF17F1-A27F-4C98-BA5A-B4319710E8D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "24CF56B0-2F4E-42A2-B655-F493AA0A4815", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "7184ABBA-B100-489E-B5C1-1C9EEC0546CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "B6D4181B-3E1B-499B-AAB1-50868A6A6AD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*", "matchCriteriaId": "8C46C55C-801E-4F86-B669-8E6A12B4AB6F", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*", "matchCriteriaId": "5A8DF8E5-61F9-4899-BF40-41A17E223441", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "B678A5A5-99CA-45B6-BB73-FB0BD2F7B9A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "691A8388-A0A3-4630-BB36-F334C670934F", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:3.15.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "E1218285-E822-45FD-8F5E-BBC80B93C6DA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value."}, {"lang": "es", "value": "Al usar el m\u00f3dulo \u2019configparser\u2019 para escribir archivos de configuraci\u00f3n que contienen valores de texto multil\u00ednea con caracteres de retorno de carro (\\r), el archivo resultante podr\u00eda ser inyectado con claves y valores inesperados si el atacante controla el valor escrito."}], "id": "CVE-2026-0864", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@python.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0864", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T18:34:23.504725Z", "version": "2.0.3"}}]}, "published": "2026-06-23T18:17:41.243", "references": [{"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8"}, {"source": "cna@python.org", "tags": ["Patch"], "url": "https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6"}, {"source": "cna@python.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/python/cpython/issues/143927"}, {"source": "cna@python.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/python/cpython/pull/151559"}, {"source": "cna@python.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/"}], "sourceIdentifier": "cna@python.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "python: cpython: Python configparser: Configuration injection via crafted multi-line input", "id": "2491892", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491892"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in the Python `configparser` module. When writing configuration files, an attacker who controls the input value can inject unexpected keys and values. This occurs if the input contains multi-line text with carriage return characters, leading to potential configuration manipulation."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-0864", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "python36", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2026-06-23T17:42:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-0864\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-0864\nhttps://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f\nhttps://github.com/python/cpython/issues/143927\nhttps://github.com/python/cpython/pull/151559\nhttps://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.15.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CPython", "source": "cna", "vendor": "Python Software Foundation"}, "product": "cpython", "vendor": "python"}], "created": "2026-06-23T21:30:07.303959+00:00", "updated": "2026-06-24T13:45:16.890642+00:00", "vendors": ["python", "python$PRODUCT$cpython"]}