CVE-2026-23949: jaraco.context Path Traversal Vulnerability
Summary
CVE-2026-23949: jaraco.context Has a Path Traversal Vulnerability. Affects jaraco-context versions >= 5.2.0, < 6.1.0. Fixed in 6.1.0. How to fix ↓
Also tracked for
- jaraco.context · ghsa
- jaraco.context · ghsa
The same CVE-2026-23949 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jaraco.context package is a Python library that provides context management utilities, particularly for handling tarball extraction. It is widely used in conjunction with setuptools for packaging and distributing Python projects. This package is essential for developers who need to manage file extraction securely. However, it has been found to contain a critical vulnerability that allows for path traversal attacks, potentially compromising the security of applications that utilize it.
Vulnerability Detail
The vulnerability arises from a Zip Slip path traversal issue in the jaraco.context package, specifically within the tarball() function. This flaw permits attackers to extract files outside the designated extraction directory when malicious tar archives are processed. The vulnerability is rooted in the strip_first_component filter, which inadequately handles path sanitization, allowing traversal sequences like '..' to escape the intended directory. This can lead to arbitrary file creation in the filesystem, posing significant risks such as unauthorized access to sensitive files and potential supply-chain attacks.
How To Fix
Minimum fixed version
6.1.0
This is the first release that contains the fix.
pip install --upgrade "jaraco-context==6.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a custom filter that sanitizes path inputs by rejecting any paths that contain '..' sequences. For example, you can modify the extraction logic as follows:
if member.name.startswith('/') or '..' in member.name: raise ValueError(f'Attempted path traversal detected: {member.name}')
Conclusion
The jaraco.context package has a critical path traversal vulnerability that can lead to severe security risks. It is essential for developers to update to the patched version 6.1.0 or later to safeguard their applications. Implementing a custom filter can serve as a temporary workaround while ensuring that best practices for security are followed.
See every vulnerability recorded for jaraco-context →
FAQ
The CVSS score for this vulnerability is 8.6, indicating a high level of severity.
Versions of jaraco.context prior to 6.1.0 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The vulnerability can lead to arbitrary file creation in the filesystem, which can result in unauthorized access to sensitive data and potential privilege escalation.
While updating is the best solution, you can implement a custom filter to sanitize paths as a temporary measure until you can upgrade.
