Critical Security Flaw in Python 3.12: Arbitrary Code Execution and Information Disclosure
Summary
ALSA-2026:10745: Important: python3.12 security update. Affects python3.12 versions < 3.12.12-4.el9_7.3. Fixed in 3.12.12-4.el9_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is a widely-used interpreted programming language known for its object-oriented features, dynamic typing, and extensive libraries. It supports various system calls and interfaces, making it a versatile choice for developers. However, recent vulnerabilities have raised concerns about its security, particularly in decompression modules and the webbrowser.open() API.
Vulnerability Detail
The vulnerabilities identified in Python 3.12 include a use-after-free issue in decompression modules, leading to potential arbitrary code execution or information disclosure (CVE-2026-6100). Additionally, a command injection vulnerability in the webbrowser.open() API allows attackers to execute arbitrary commands (CVE-2026-4786). These vulnerabilities can be exploited by malicious actors to compromise systems running affected versions of Python.
How To Fix
Minimum fixed version
3.12.12-4.el9_7.3
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features in the decompression modules and refrain from utilizing the webbrowser.open() API until the update is applied. However, this is not a permanent solution and updating is strongly recommended.
Conclusion
The vulnerabilities in Python 3.12 present significant security risks, including arbitrary code execution and information disclosure. It is crucial for users to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
The vulnerabilities involve arbitrary code execution and information disclosure due to a use-after-free issue and command injection in specific APIs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using the affected features as a temporary workaround until you can apply the patch.
Yes, not updating exposes your system to potential exploitation by attackers, which could lead to unauthorized access or data breaches.
More details can be found on the CVE pages for CVE-2026-4786 and CVE-2026-6100, which provide in-depth information about the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
