Configuration Injection via Carriage Return (\r) in write() method
Priority LOW 18CWE-74Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00126 2nd percentileScored 2026-11-07
Fix Partial CPython (Python Software Foundation): 3.10.21, 3.11.16, 3.12.14 +3Red Hat: 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation | CPython | before 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.15; 3.14.0 to before 3.14.7; 3.15.0a1 to before 3.15.0b4 | 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0b4 | Patch available | CNA |
- CPython VendorPython Software Foundation Affected before 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.15; 3.14.0 to before 3.14.7; 3.15.0a1 to before 3.15.0b4 Fixed in 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0b4 Patch available CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | before 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.15; 3.14.0 to before 3.14.7 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:* | 3.15.0 alpha1 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:* | 3.15.0 alpha2 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:* | 3.15.0 alpha3 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:* | 3.15.0 alpha4 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:* | 3.15.0 alpha5 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:* | 3.15.0 alpha6 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:* | 3.15.0 alpha7 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:* | 3.15.0 alpha8 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:* | 3.15.0 beta1 | Vulnerable | python-pillow |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions before 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.15; 3.14.0 to before 3.14.7 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:* Versions 3.15.0 alpha1 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:* Versions 3.15.0 alpha2 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:* Versions 3.15.0 alpha3 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:* Versions 3.15.0 alpha4 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:* Versions 3.15.0 alpha5 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:* Versions 3.15.0 alpha6 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:* Versions 3.15.0 alpha7 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:* Versions 3.15.0 alpha8 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:beta1:*:*:*:*:*:* Versions 3.15.0 beta1 Vulnerable ·python-pillow
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:3.15.0:beta2:*:*:*:*:*:* | 3.15.0 beta2 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.15.0:beta3:*:*:*:*:*:* | 3.15.0 beta3 | Vulnerable | python-pillow |
- cpe:2.3:a:python:python:3.15.0:beta2:*:*:*:*:*:* Versions 3.15.0 beta2 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.15.0:beta3:*:*:*:*:*:* Versions 3.15.0 beta3 Vulnerable ·python-pillow
Remediation
- Fix · CNA CPython (Python Software Foundation) Fixed in 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0b4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Python Software Foundation CPython 3.10.21, 3.11.16 and 4 more versions
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-10297 tarfile extraction filter bypass allows escaping the destination directoryPriority MEDIUM 41
- TI-2026-10316 tarfile opened in streaming mode mishandles EOFPriority LOW 37
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux command line assistant | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
Not affected: 5 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-0864
- 2026-10-03 Alias added: GHSA-g345-7jg6-m22p
- 2026-10-07 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
Patch 9
- https://github.com/python/cpython/pull/151559
- https://github.com/python/cpython/issues/143927
- https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f
- https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528
- https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98
- https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8
- https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6
- https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd
- https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908
More Python Software Foundation vulnerabilities
- TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
- TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
- TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
- TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
- TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
- TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
Sources
- CVE-2026-0864 · CVE Program
- CVE-2026-0864 · NVD
- FIRST EPSS
- GHSA-g345-7jg6-m22p · GitHub Advisory Database · CC BY 4.0
- CVE-2026-0864 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences