Critical Security Update for Python 3.9: Command Injection and Code Execution Vulnerabilities
Summary
ALSA-2026:19216: Important: python3.9 security update. Affects python-unversioned-command versions < 3.9.25-7.el9_8. Fixed in 3.9.25-7.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.9 is a widely used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms and is equipped with extensive libraries and frameworks. However, recent vulnerabilities have been identified that could lead to command injection and arbitrary code execution, posing significant risks to applications relying on this version.
Vulnerability Detail
The vulnerabilities in Python 3.9 stem from command-line option injection in the webbrowser.open() function and a use-after-free issue in decompression modules. These flaws can allow attackers to execute arbitrary code or disclose sensitive information. Specifically, crafted URLs can exploit the webbrowser.open() API, leading to potential command injection attacks. The use-after-free vulnerability can be exploited during decompression processes, allowing unauthorized code execution.
How To Fix
Minimum fixed version
3.9.25-7.el9_8
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the webbrowser.open() function with untrusted URLs. Validate and sanitize any URLs before passing them to this function to mitigate the risk of command injection.
Conclusion
The vulnerabilities identified in Python 3.9 present serious security risks that can lead to command injection and arbitrary code execution. It is crucial to update to the patched version 3.9.25-7.el9_8 to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for python-unversioned-command →
FAQ
The vulnerabilities involve command injection and arbitrary code execution due to flaws in the webbrowser.open() function and decompression modules.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, ensure to validate and sanitize URLs used with the webbrowser.open() function to reduce risk.
Yes, ensure to update all related packages, including python3, python3-devel, and python3-libs, to the patched version 3.9.25-7.el9_8.
Failure to address these vulnerabilities could lead to unauthorized code execution, data breaches, and compromise of application integrity.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
