---
id: CVE-2026-0864
title: |-
  When using the "configparser" module to write configuration files
  containing multi-line text values with carriage return characters (\r) the
  resulting file could be injected with unexpected keys and values if the
  attacker controls the wr…
summary: |-
  When using the "configparser" module to write configuration files
  containing multi-line text values with carriage return characters (\r) the
  resulting file could be injected with unexpected keys and values if the
  attacker controls the wr…
severity: none
cwe:
  - CWE-74
published: '2026-06-23'
updated: '2026-08-06'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0864'
references:
  - url: >-
      https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/143927'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/151559'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/
    label: cna@python.org
tags:
  - nvd
epss: 0.00184
epssPercentile: 0.07072
ingestedAt: '2026-08-06T20:03:56.183Z'
---

## Overview

When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.