CVE-2026-0864
Full vulnerability record from the local CVENow database.
Description
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Severity
MEDIUM
CVSS score
4.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-23 18:17:41.243000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-0864",
"sourceIdentifier": "[email protected]",
"published": "2026-06-23T18:17:41.243",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value."
},
{
"lang": "es",
"value": "Al usar el módulo ’configparser’ para escribir archivos de configuración que contienen valores de texto multilínea con caracteres de retorno de carro (\\r), el archivo resultante podría ser inyectado con claves y valores inesperados si el atacante controla el valor escrito."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Python Software Foundation",
"product": "CPython",
"defaultStatus": "unaffected",
"repo": "https://github.com/python/cpython",
"versions": [
{
"version": "0",
"lessThan": "3.10.21",
"versionType": "python",
"status": "affected"
},
{
"version": "3.11.0",
"lessThan": "3.11.16",
"versionType": "python",
"status": "affected"
},
{
"version": "3.12.0",
"lessThan": "3.12.14",
"versionType": "python",
"status": "affected"
},
{
"version": "3.13.0",
"lessThan": "3.13.15",
"versionType": "python",
"status": "affected"
},
{
"version": "3.14.0",
"lessThan": "3.14.7",
"versionType": "python",
"status": "affected"
},
{
"version": "3.15.0a1",
"lessThan": "3.15.0b4",
"versionType": "python",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-23T18:34:23.504725Z",
"id": "CVE-2026-0864",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-74"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.21",
"matchCriteriaId": "35C0374F-6CC2-4546-8933-B382CD3A9225"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.11.0",
"versionEndExcluding": "3.11.16",
"matchCriteriaId": "D409E2A6-22F1-47D5-A273-4772BF45925E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.0",
"versionEndExcluding": "3.12.14",
"matchCriteriaId": "15B3E361-E948-4A55-A163-E681B8E0EF16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.13.0",
"versionEndExcluding": "3.13.15",
"matchCriteriaId": "7DBD3E4F-47FF-48C4-8A44-D2EC2AF84E3C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.14.0",
"versionEndExcluding": "3.14.7",
"matchCriteriaId": "4EA7DE57-F5C8-4AD0-A8A8-5E9C3FC75310"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A3327507-0B1D-4F28-A983-D07A2C8A7696"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "C8AF17F1-A27F-4C98-BA5A-B4319710E8D1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*",
"matchCriteriaId": "24CF56B0-2F4E-42A2-B655-F493AA0A4815"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*",
"matchCriteriaId": "7184ABBA-B100-489E-B5C1-1C9EEC0546CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*",
"matchCriteriaId": "B6D4181B-3E1B-499B-AAB1-50868A6A6AD3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*",
"matchCriteriaId": "A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*",
"matchCriteriaId": "8C46C55C-801E-4F86-B669-8E6A12B4AB6F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*",
"matchCriteriaId": "5A8DF8E5-61F9-4899-BF40-41A17E223441"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B678A5A5-99CA-45B6-BB73-FB0BD2F7B9A3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "691A8388-A0A3-4630-BB36-F334C670934F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "E1218285-E822-45FD-8F5E-BBC80B93C6DA"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/issues/143927",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://github.com/python/cpython/pull/151559",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://mail.python.org/archives/list/[email protected]/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/",
"source": "[email protected]",
"tags": [
"Mailing List",
"Vendor Advisory"
]
}
]
}