CVE-2026-0864

Summary

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Affected Software

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/python/cpython/pull/151559
• https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/
• https://github.com/python/cpython/issues/143927
• https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f
• https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528
• https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98
• https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8

• ←Previous
• Next→