{"id":"CVE-2026-0864","title":"When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the wr…","summary":"When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the wr…","severity":"none","cwe":["CWE-74"],"published":"2026-06-23","updated":"2026-08-06","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0864","references":[{"url":"https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6","label":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/143927","label":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/151559","label":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/","label":"cna@python.org"}],"tags":["nvd"],"epss":0.00126,"epssPercentile":0.02642,"ingestedAt":"2026-08-06T20:03:56.183Z","slug":"CVE-2026-0864","body":"## Overview\n\nWhen using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}