Critical Security Update for Python 3.12: Addressing Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2026:10711: Important: python3.12 security update. Affects python-unversioned-command versions < 3.12.12-3.el10_1.3. Fixed in 3.12.12-3.el10_1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various programming paradigms and is equipped with extensive libraries and frameworks, making it a popular choice for developers. However, recent vulnerabilities have been identified in Python 3.12, specifically affecting its decompression modules and the webbrowser.open() API, which could lead to severe security risks.
Vulnerability Detail
The vulnerabilities identified in Python 3.12 include a use-after-free issue in decompression modules (CVE-2026-6100) that could allow arbitrary code execution or information disclosure. Additionally, a command injection vulnerability in the webbrowser.open() API (CVE-2026-4786) poses a risk of arbitrary code execution. These vulnerabilities stem from improper handling of memory and user input, potentially allowing attackers to exploit these weaknesses to execute malicious code or access sensitive information.
How To Fix
Minimum fixed version
3.12.12-3.el10_1.3
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the affected functionalities, such as the decompression modules and the webbrowser.open() API, until the packages are updated. Additionally, implementing strict input validation can help mitigate the risks associated with command injection.
Conclusion
The vulnerabilities in Python 3.12 present significant security risks that can lead to arbitrary code execution and information disclosure. It is crucial for users to update their packages to the patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python-unversioned-command →
FAQ
The vulnerabilities involve arbitrary code execution and information disclosure due to improper memory handling and command injection.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, avoid using the affected functionalities and implement strict input validation as a temporary measure.
Failure to address these vulnerabilities could lead to arbitrary code execution, allowing attackers to gain unauthorized access to your system or sensitive data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
