Critical Security Flaw in Python 3.11: Arbitrary Code Execution and Information Disclosure
Summary
ALSA-2026:10774: Important: python3.11 security update. Affects python3.11 versions < 3.11.13-5.3.el9_7. Fixed in 3.11.13-5.3.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.11 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a versatile choice for developers. However, recent vulnerabilities have raised concerns about its security, particularly in decompression modules and the webbrowser API.
Vulnerability Detail
The vulnerability arises from a use-after-free issue in decompression modules, which could lead to arbitrary code execution or information disclosure (CVE-2026-6100). Additionally, there is a command injection vulnerability in the webbrowser.open() API (CVE-2026-4786), allowing attackers to execute arbitrary commands. These vulnerabilities can severely compromise the integrity and confidentiality of applications using Python 3.11.
How To Fix
Minimum fixed version
3.11.13-5.3.el9_7
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected functionalities in the decompression modules and the webbrowser API until the package is updated. This may involve modifying your code to prevent reliance on these features.
Conclusion
The vulnerabilities identified in Python 3.11 present serious security risks, including arbitrary code execution and information disclosure. It is crucial for developers and organizations to update to the latest patched version to protect their applications. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for python3.11 →
FAQ
The vulnerabilities include a use-after-free issue leading to arbitrary code execution or information disclosure and a command injection vulnerability in the webbrowser.open() API.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerabilities using the Vulert playground at Vulert Scanner.
The vulnerabilities can lead to unauthorized code execution, data breaches, and compromise of application integrity, posing significant risks to users and systems.
Yes, a patch is available in the form of an updated version of Python 3.11 (3.11.13-5.3.el9_7). It is recommended to update to this version to mitigate the risks.
If immediate updates are not possible, consider implementing workarounds by avoiding the use of the affected functionalities until a secure version can be deployed.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
