Dashboard / CVE-2026-0864

CVE-2026-0864

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 18/100
Published: 2026-06-23 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: High
UI: Passive
S: X
AT: Present
VC: None
VI: High
VA: None

Description

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Weakness Classification (1)

Affected Software (16)

VendorProductVersion
python python < 3.10.21
python python 3.11.0 – 3.11.16
python python 3.12.0 – 3.12.14
python python 3.13.0 – 3.13.15
python python 3.14.0 – 3.14.7
python python 3.15.0
python python 3.15.0
python python 3.15.0
python python 3.15.0
python python 3.15.0
python python 3.15.0
python python 3.15.0
python python 3.15.0
python python 3.15.0
python python 3.15.0
python python 3.15.0

References & Advisories (10)

Bug Bounty Relevance

18 / 100
✓ Low complexity

CVSS Score

4.1 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.13%
Raw Score 0.001260
Percentile 2.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00126
2026-10-28
0.00126

Intelligence Sources

nvd ref →

External Links