Critical Security Flaw in Python 3.11: Arbitrary Code Execution and Information Disclosure
Summary
ALSA-2026:11062: Important: python3.11 security update. Affects python3.11 versions < 3.11.13-7.el8_10. Fixed in 3.11.13-7.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.11 is an advanced, interpreted programming language known for its object-oriented features, dynamic typing, and extensive libraries. It supports various system calls and windowing systems, making it a versatile choice for developers. However, recent vulnerabilities have exposed it to significant security risks, particularly in its decompression modules and web browser API.
Vulnerability Detail
The vulnerabilities in Python 3.11 stem from a use-after-free issue in decompression modules, which can lead to arbitrary code execution or information disclosure (CVE-2026-6100). Additionally, a command injection vulnerability in the webbrowser.open() API (CVE-2026-4786) allows attackers to execute arbitrary commands. These vulnerabilities can compromise system integrity and expose sensitive information, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
3.11.13-7.el8_10
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected decompression modules and refrain from utilizing the webbrowser.open() API until the update is applied. This can help mitigate the risk of exploitation while waiting for the patch.
Conclusion
The vulnerabilities in Python 3.11 present significant security risks that require immediate attention. Users are strongly advised to update to the latest patched version to protect their systems from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for python3.11 →
FAQ
The vulnerabilities involve arbitrary code execution and information disclosure due to flaws in decompression modules and the webbrowser.open() API.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Failure to address these vulnerabilities can lead to unauthorized access, data breaches, and potential system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, avoid using the affected features and monitor for updates regularly until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
