CVE-2026-2297
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In CPython, the import hook handling legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and does not use io.open_code() to read the .pyc files. Consequently, sys.audit handlers for this audit event do not fire.
Risk Assessment
Missing audit events may hide dangerous .pyc file read operations, potentially hindering detection of malicious activity and violating security compliance.
Recommendation
Update CPython to a version where SourcelessFileLoader handling is fixed. If not possible, consider manually auditing .pyc file operations.
Other vulnerabilities in CPython
See all- CVE-2021-23336Medium
A vulnerability in CPython (from version 0 to 3.6.13, 3.7.0-3.7.10, 3.8.0-3.8.8, 3.9.0-3.9.2) allows Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs functions. An attacker can use a technique called 'parameter cloaking' to manipulate query parameters.
- CVE-2024-6923Medium
In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.
- CVE-2024-11168Medium
The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.
- CVE-2024-6232Medium
A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.
- CVE-2024-8088Medium
A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.
- CVE-2024-9287Medium
In CPython, the venv module and CLI do not properly quote paths when creating a virtual environment, allowing injection of commands into activation scripts (e.g., source venv/bin/activate). This enables arbitrary code execution upon activation.
- CVE-2024-7592Low
In CPython's 'http.cookies' module, parsing cookies with backslash-escaped characters uses a quadratic algorithm, causing excessive CPU usage.
- CVE-2025-4516Medium
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler, you are not affected. To work around, stop using the error= handler and wrap the bytes.decode() call in a try-except catching DecodeError.
- CVE-2024-5642Medium
CPython 3.9 and earlier does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used. This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in practice.
- CVE-2023-6507Medium
In CPython 3.12.0 in the subprocess module on POSIX platforms, when the extra_groups=[] parameter is used, the process does not call setgroups(0, NULL) before exec(), causing the new process to inherit the parent process's groups. This issue was fixed in CPython 3.12.1 and only affects processes run with root privileges.
Original NVD description (English source)
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.