527 matches found
CVE-2026-115791
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
AZL-113326 CVE-2026-115791 affecting package python-py 1.11.0-1
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
CVE-2026-115791
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
AZL-113332 CVE-2026-115791 affecting package python3 3.12.16-2
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
CVE-2026-115791 Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
CVE-2026-115791 Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
EUVD-2026-121328
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
CVE-2026-115791
The Python tarfile and zipfile command line interfaces (CLI) are vulnerable to a local security issue where a malicious archive can create a Python script that shadows a standard library module during decompression. Because Python adds the current directory to sys.path when running python -m MODU...
CVE-2026-115791
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
CVE-2026-115791 Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
CVE-2026-115791: Python Software Foundation CPython: When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the…
When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...
node-cve-2026-106070-check
node-cve-2026-106070-check Offline version-evidence checker for CVE-2026-106070, Node.js: ZipFile invalid-header content substitution. It compares Node.js runtime versions that you report against the fixed release named in the vendor advisory and writes a CSV, JSON or HTML triage report. Python...
Node.js 26.12.0 ZipFile Invalid-Header Content Substitution
Node.js versions before 26.12.1 in the 26.x branch contain a ZipFile invalid-header content substitution flaw that can return attacker-controlled prefix bytes after failed ZIP header validation. This tool evaluates operator-supplied Node.js version evidence offline...
Node.js 26.12.0 ZipFile Invalid-Header Content Substitution
Node.js version 26.x prior to 26.12.1 contains a ZipFile invalid-header content-substitution issue when an untrusted ZIP file is processed after property modification or compaction...
Exploit for CVE-2026-106070
node-cve-2026-106070-check Standalon...
CVE-2026-106070
A flaw in the Node.js "zlib.ZipFile" API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When "zipEntry.modified" is read on an archive whose local header does not match its central directory, either directly or while...
Node.js 26.x < 26.12.1 Multiple Vulnerabilities
The version of Node.js installed on the remote host is prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - The ZipFile implementation returns attacker-controlled prefix bytes after a failed ZIP...
SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:4809-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4809-1 advisory. - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. - CVE-2026-15806:...
Security update for python311
This update for python311 fixes the following issues: CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme bsc1276223. CVE-2026-17084: StringPrep...
Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141781)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141781 advisory. An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to...