{"id":"CVE-2026-115791","published":"2026-11-10T17:17:22.853","lastModified":"2026-11-11T05:19:25.817","description":"When tarfile or zipfile command line interface (CLI) is used to\n\ndecompress an archive, a Python script shadowing the stdlib can be\n\ncreated. Then if an error occurs during decompressing the next file,\n\nthe newly created Python script is executed. This is especially true\n\nif the created Python is called traceback.py. The problem is that\n\nPython adds the current directory to sys.path when python -m MODULE is\n\nrun, and the archive is also decompressed in the current directory.\n\n\n\nThe fix removes sys.path[0] in gzip, tarfile and zipfile command line\n\ninterface to prevent shadowing standard library modules from extracted\n\nfiles.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-829"],"vendors":[],"products":[],"references":[{"url":"https://github.com/python/cpython/issues/161705","tags":[]},{"url":"https://github.com/python/cpython/pull/161706","tags":[]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/ZKKA4Q7B35JEHSDIJNZ6TYKRDQJUHDAG/","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/10/30","tags":[]}],"exploitRefs":[{"url":"https://github.com/python/cpython/issues/161705","tags":[]},{"url":"https://github.com/python/cpython/pull/161706","tags":[]}],"hasPoc":true,"ai":null}