Medium severity · published Jun 23, 2026
CVE-2026-0864
Configuration Injection via Carriage Return (\r) in write() method
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0a1 before 3.15.0b4 · source: vendor
PY
Python · Python
before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0864
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0864
Patch
https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528
Patch
https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd
Patch
https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908
Patch
https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f
Patch
https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98
Patch
https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF