International
The Morning Dev

Only the news worth knowing

‹
 
B43/100

Vulnerability · medium · CVSS 5.3

CPython gzip, tarfile and zipfile CLIs fixed to stop shadowing stdlib (CVE-2026-115791)

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Users running these CPython CLIs from directories with untrusted files

Tier B because: Full takeover OR secrets exposed OR supply chain

Reach

Attack

Damage

Fix

Popular tool · Full takeover

What to do

  1. Upgrade CPython to a release that includes the fix for CVE-2026-115791

The Brief

  • CPython fixed the gzip, tarfile and zipfile command-line interfaces so they no longer shadow standard library modules.
  • The issue is tracked as CVE-2026-115791 and was announced on the Security-announce list on 2026-11-10.

Why it matters

Developers who run these CLI tools from directories containing untrusted files could have the wrong module loaded instead of the standard library version.

The checklist behind the tier

Checklist · 3 of 10 yes
YesHits tech teamsJudgment: CPython is a runtime developers build and run software with.
NoCore infrastructureJudgment: a stdlib CLI shadowing flaw in CPython is not core infrastructure like OpenSSH or the Linux kernel.
YesPopular toolJudgment: Python is a widely used mainstream language platform, so its flaws affect many teams.
NoExploited in the wildOpen Source Security: the post only announces a fix for CVE-2026-115791; no observed attacks reported.
NoPublic exploitOpen Source Security: the forwarded announcement mentions no published exploit or proof-of-concept.
NoRemote, no loginCVSSCVSS: CVE-2026-115791 AV:L/PR:L/UI:A
YesFull takeoverCVSSCVE-2026-115791: CVSS rates confidentiality and integrity impact high
NoSecrets exposedOpen Source Security: no report of stolen credentials, tokens, or data in the announcement.
NoSupply chainOpen Source Security: a normal stdlib bug fix; no compromised package, build, or signing key reported.
NoNo fix yetOpen Source Security: CPython announces the fix that prevents stdlib shadowing in these CLIs.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-115791 ↗CVSS 5.3 medium AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

    Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction

    Exploited
    Not in CISA’s exploited catalog
    Weakness
    CWE-829

    NVDGHSA-mcvr-4p4q-h9hh

Timeline

  1. Fix for stdlib shadowing in gzip/tarfile/zipfile CLI announced to the Security-announce list

  2. Open Source Security

    CPython: [CVE-2026-115791] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI

Source

CPython: [CVE-2026-115791] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI ↗ Open Source Security · 1h ago

First seen · 1 source · Full story page · How tiers are decided