[CVE-2026-3479] pkgutil.get_data does not enforce documented restrictions
March 18, 2026
5:58 p.m.
There is a LOW severity vulnerability affecting CPython.
pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
Please see the linked CVE ID for the latest information on affected versions:
85
Age (days ago)
85
Last active (days ago)
0 comments
1 participants
participants (1)
-
Stan Ulbrych