Medium 4.1Published Jun 23, 2026

CVE-2026-0864Configuration Injection via Carriage Return (\r) in write() method

Updated under an hour ago (Oct 27, 2026, 4:30 PM ET)

Does this affect you?

It affects Python Software Foundation CPython and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

CVSS: 4.1 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-74
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Analyzed
Record last updated: Aug 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.10.21; from 3.11.0 before 3.11.16; from 3.12.0 before 3.12.14; from 3.13.0 before 3.13.15; from 3.14.0 before 3.14.7; from 3.15.0a1 before 3.15.0b4	CNA record
python python python:python	before 3.10.21; from 3.11.0 before 3.11.16; from 3.12.0 before 3.12.14; from 3.13.0 before 3.13.15; from 3.14.0 before 3.14.7; 3.15.0; 3.15.0; 3.15.0; and 8 more ranges	NVD

References

References

https://github.com/python/cpython/pull/151559	patch, issue-tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/	vendor-advisory, mailing-list
https://github.com/python/cpython/issues/143927	issue-tracking, patch
https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f	patch
https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528	patch
https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98	patch
https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8	patch
https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6	patch
https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd	patch
https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.