CPython: [CVE-2026-115791] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI

The Brief

CPython fixed the gzip, tarfile and zipfile command-line interfaces so they no longer shadow standard library modules.
The issue is tracked as CVE-2026-115791 and was announced on the Security-announce list on 2026-11-10.

Why it matters

Developers who run these CLI tools from directories containing untrusted files could have the wrong module loaded instead of the standard library version.

Who’s affected

Python developers running the gzip, tarfile or zipfile command-line tools

What to do

Upgrade CPython to a release that includes the fix for CVE-2026-115791

CVE-2026-115791
#python
#cpython
#security
#stdlib
#cve

Posted by Alan Coopersmith on Nov 10 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-115791] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI Date: Tue, 10 Nov 2026 17:00:26 +0100 From: Victor Stinner <vstinner () python org> Reply-To: security-sig…

Read the full story at seclists.org ↗

Timeline

Nov 10
Fix for stdlib shadowing in gzip/tarfile/zipfile CLI announced to the Security-announce list
Nov 10 · 10:32 PM
Open Source Security
CPython: [CVE-2026-115791] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI