https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 22:08:12 +0000 https://db.gcve.eu/vuln/cve-2026-115791 <p><strong>Affected:</strong> Python Software Foundation CPython</p> <p>When tarfile or zipfile command line interface (CLI) is used to</p> <p>decompress an archive, a Python script shadowing the stdlib can be</p> <p>created. Then if an error occurs during decompressing the next file,</p> <p>the newly created Python script is executed. This is especially true</p> <p>if the created Python is called traceback.py. The problem is that</p> <p>Python adds the current directory to sys.path when python -m MODULE is</p> <p>run, and the archive is also decompressed in the current directory.</p> <p>The fix removes sys.path[0] in gzip, tarfile and zipfile command line</p> <p>interface to prevent shadowing standard library modules from extracted</p> <p>files.</p> <p><strong>Affected:</strong> Python Software Foundation CPython</p> <p>When tarfile or zipfile command line interface (CLI) is used to</p> <p>decompress an archive, a Python script shadowing the stdlib can be</p> <p>created. Then if an error occurs during decompressing the next file,</p> <p>the newly created Python script is executed. This is especially true</p> <p>if the created Python is called traceback.py. The problem is that</p> <p>Python adds the current directory to sys.path when python -m MODULE is</p> <p>run, and the archive is also decompressed in the current directory.</p> <p>The fix removes sys.path[0] in gzip, tarfile and zipfile command line</p> <p>interface to prevent shadowing standard library modules from extracted</p> <p>files.</p> https://db.gcve.eu/vuln/cve-2026-115791