CVE-2026-0864— Configuration Injection via Carriage Return (\r) in write() method
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.10.21 | affected |
3.11.0< 3.11.16 | affected | ||
3.12.0< 3.12.14 | affected | ||
3.13.0< 3.13.15 | affected | ||
3.14.0< 3.14.7 | affected | ||
3.15.0a1< 3.15.0b4 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-0864
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Configuration Injection via Carriage Return (\r) in write() method
Source: CVE Program / CVE List V5
Vulnerability Description
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Python 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Python Software Foundation CPython是Python Software Foundation基金会的编程语言解释器。 Python 3.15.0之前版本存在输入验证错误漏洞，该漏洞源于使用“configparser”模块写入包含回车字符（\r）的多行文本值的配置文件时，若攻击者控制写入值，可能注入意外键和值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Python Software Foundation | CPython | 0 ~ 3.10.21 | - |
II. Public POCs for CVE-2026-0864
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-0864
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-0864 (4)
Mailing List Discussions for CVE-2026-0864 (1)
Same Patch Batch · Python Software Foundation · 2026-06-23 · 3 CVEs total
| CVE-2026-11972 | 8.2 HIGH | tarfile opened in streaming mode mishandles EOF |
| CVE-2026-11940 | 7.8 HIGH | tarfile extraction filter bypass allows escaping the destination directory |
IV. Related Vulnerabilities
Same product: CPython
- CVE-2026-18503
Super-linear CPU usage for unbounded input to csv.Sniffer.sn - CVE-2026-6879
Quadratic Behavior in xml.etree.ElementPath Index Predicates - CVE-2026-15308
Incremental HTMLParser feed() allows CPU-exhaustion DoS via - CVE-2026-4360
Tarfile.extract() doesn't fully respect filter parameter - CVE-2026-11972
tarfile opened in streaming mode mishandles EOF
Same vendor: Python Software Foundation
- CVE-2026-18503
Super-linear CPU usage for unbounded input to csv.Sniffer.sn - CVE-2026-6879
Quadratic Behavior in xml.etree.ElementPath Index Predicates - CVE-2026-15308
Incremental HTMLParser feed() allows CPU-exhaustion DoS via - CVE-2026-4360
Tarfile.extract() doesn't fully respect filter parameter - CVE-2026-11972
tarfile opened in streaming mode mishandles EOF
V. Comments for CVE-2026-0864
No comments yet