Critical Security Flaw in Python3 Packages: Arbitrary Code Execution and Information Disclosure
Summary
ALSA-2026:11077: Important: python3 security update. Affects platform-python versions < 3.6.8-76.el8_10.alma.1. Fixed in 3.6.8-76.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms and includes features such as dynamic typing, modules, and classes. The affected packages in this vulnerability include platform-python, platform-python-debug, platform-python-devel, python3-idle, python3-libs, python3-test, and python3-tkinter, all of which are essential for running Python applications on AlmaLinux 8. These packages are integral to the development and execution of Python applications, making their security paramount.
Vulnerability Detail
This vulnerability arises from a use-after-free issue in the decompression modules of Python, which can lead to arbitrary code execution or information disclosure. Specifically, the vulnerabilities identified as CVE-2026-6100 and CVE-2026-4786 allow attackers to execute arbitrary commands through the webbrowser.open() API, potentially compromising the integrity and confidentiality of the system. The ramifications of this vulnerability are severe, as it could allow unauthorized access to sensitive data or system control.
How To Fix
Minimum fixed version
3.6.8-76.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the vulnerable webbrowser.open() API until the packages are updated. This can help mitigate the risk of arbitrary code execution while waiting for the official patch.
Conclusion
The identified vulnerabilities in Python3 packages pose significant security risks, including arbitrary code execution and information disclosure. It is crucial for users to update their packages to the latest patched version to safeguard their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform-python →
FAQ
The vulnerability involves arbitrary code execution and information disclosure due to a use-after-free issue in Python's decompression modules.
The affected packages include platform-python, platform-python-debug, platform-python-devel, python3-idle, python3-libs, python3-test, and python3-tkinter.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid using the vulnerable webbrowser.open() API as a temporary workaround to reduce risk.
More details about the vulnerabilities can be found on the CVE pages for CVE-2026-4786 and CVE-2026-6100.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
