CVE-2015-1326: python-dbusmock AddTemplate() Method Code Execution
Summary
CVE-2015-1326: python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file. Affects python-dbusmock across 2 version ranges.
< 0.15.1
< 4e7d0df9093
Fixed in 0.15.1 or 4e7d0df9093, depending on the release line you run. How to fix ↓
Also tracked for
- python-dbusmock · Debian:11
The same CVE-2015-1326 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-dbusmock is a Python library that provides a mock D-Bus server for testing purposes. It allows developers to simulate D-Bus services and test their applications without relying on actual D-Bus servers. The library is widely used in the Python ecosystem and is available on PyPI. However, prior to version 0.15.1, python-dbusmock is vulnerable to a code execution vulnerability in the AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method. This vulnerability can be exploited by an attacker who supplies a malicious .pyc file.
Vulnerability Detail
The vulnerability in python-dbusmock arises from the lack of proper input validation when handling .pyc files. An attacker can craft a malicious .pyc file and supply it to the AddTemplate() method or the spawn_server_template() method. When executed, the malicious code within the .pyc file will be executed in the context of the python-dbusmock process. This can lead to arbitrary code execution and potential compromise of the system. The vulnerability was first reported in April 2019 and has been assigned the CVE identifier CVE-2015-1326.
How To Fix
Latest published version: 0.38.1 as of 23 Oct 2026
pip install --upgrade "python-dbusmock==0.38.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.15.10.15.1pip install --upgrade "python-dbusmock==0.15.1" -
< 4e7d0df90934e7d0df9093pip install --upgrade "python-dbusmock==4e7d0df9093"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of python-dbusmock as soon as possible.
Conclusion
The python-dbusmock library prior to version 0.15.1 is vulnerable to a code execution vulnerability when handling .pyc files. This can be exploited by an attacker to execute arbitrary code in the context of the python-dbusmock process. To mitigate this vulnerability, users should update to version 0.15.1 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python-dbusmock →
FAQ
python-dbusmock is a Python library that provides a mock D-Bus server for testing purposes. It allows developers to simulate D-Bus services and test their applications without relying on actual D-Bus servers.
This vulnerability allows an attacker to execute arbitrary code in the context of the python-dbusmock process. This can lead to system compromise and unauthorized access to sensitive information.
To fix this vulnerability, update your python-dbusmock installation to version 0.15.1 or later. This version includes proper input validation when handling .pyc files.
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of python-dbusmock.
You can check if your application is affected by this vulnerability by using the Vulert playground at Vulert Scanner. Simply provide your Pipfile.lock and the playground will analyze it for open-source vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-dbusmock.
