CVE-2026-4360

CVE-2026-4360 affects Python’s tarfile module, where TarFile.extract() fails to propagate the filter parameter for hardlinks, allowing extraction from untrusted tar archives to write files with unexpected uid/gid even when filter='data' is requested. The issue is documented in CPython commits/iss...