By vendor

Python vulnerabilities

Known CVEs affecting Python products, prioritized by severity, with SEC.co remediation and detection guidance.

8 published vulnerabilities

• CVE-2026-15308HIGH 7.5

  Python's built-in HTML parser can be forced to consume excessive CPU resources when processing specially crafted HTML containing repeated unterminated markup declarations. An attacker who can submit or inject malicious HTML into an application using Python's html.parser.HTMLParser can trigger a denial-of-service condition, potentially freezing or slowing the affected service. This vulnerability affects the standard library across Python versions and requires no authentication or user interaction to exploit.

• CVE-2026-54059HIGH 7.5

  A flaw in Pillow (a widely-used Python image processing library) before version 12.3.0 allows attackers to craft malicious PCF font files that trigger excessive memory allocation on systems that process them. When a vulnerable version of Pillow reads such a file, it fails to validate the font's internal dimensions properly, potentially exhausting available memory and crashing the application or system. The vulnerability requires no user authentication or special privileges—a remote attacker can exploit it by simply hosting or distributing a poisoned font file.

• CVE-2026-54060HIGH 7.5

  Pillow, a widely-used Python library for image manipulation, contains a vulnerability in how it processes font files. When converting fonts to bitmap format, the library can be tricked into allocating excessive memory without proper safety checks, causing the application to consume resources uncontrollably and crash. This affects Pillow versions before 12.3.0. An attacker can exploit this by providing a specially crafted font file to any application using Pillow, requiring no special privileges or user interaction.

• CVE-2026-55379HIGH 7.5

  Pillow, a widely-used Python image processing library, contains a vulnerability that allows attackers to consume excessive memory on systems processing untrusted BDF (Bitmap Distribution Format) font files. When Pillow reads a maliciously crafted BDF font, it extracts dimension fields without validating whether they would trigger a decompression bomb—a file designed to expand to enormous size in memory. An attacker can supply a BDF font file with extremely large width and height values, causing Pillow to attempt allocating gigabytes of memory, leading to denial of service. The vulnerability bypasses Pillow's built-in protection mechanism that normally catches such attacks.

• CVE-2026-55380HIGH 7.5

  Pillow, a widely-used Python image processing library, contains a flaw in how it handles GD 2.x image files. When Pillow opens a malicious .gd file, it reads dimension information from the file header without validating whether those dimensions are excessively large. This allows an attacker to craft a file that tricks Pillow into allocating enormous amounts of memory on the host system, potentially causing a denial of service. The vulnerability was fixed in Pillow version 12.3.0.

• CVE-2026-59890MEDIUM 6.1

  setuptools, a core Python package management tool, contains a vulnerability in how it handles file exclusion rules when building source distributions. On macOS systems using APFS or HFS+ filesystems, attackers or malicious developers can bypass intended file exclusion directives by exploiting Unicode normalization differences. Specifically, files named with decomposed Unicode characters (NFD form) can be packed into distributed Python packages even when exclusion rules target the composed form (NFC). This allows sensitive or malicious files to be included in source distributions when they should have been excluded, potentially affecting downstream package users.

• CVE-2026-4360MEDIUM 5.3

  CVE-2026-4360 is a vulnerability in Python's tarfile extraction mechanism where the security filter parameter is bypassed when extracting hardlinks from tar archives. When a developer uses the `filter='data'` parameter—intended to restrict file ownership changes—the filter is not applied to hardlinks, allowing an attacker to craft a malicious tar file that assigns unexpected user and group identifiers (uid/gid) to extracted files. This could lead to privilege escalation or file ownership manipulation on systems processing untrusted archives.

• CVE-2026-55798MEDIUM 4.5

  Pillow, a widely-used Python image processing library, contains a command injection vulnerability in its Windows image viewer functionality. When Pillow opens an image file on Windows, it constructs a system command to display the image, but fails to properly escape the file path before passing it to the shell. An attacker can craft a malicious image file with shell metacharacters in its name—such as ampersands or pipes—to inject and execute arbitrary Windows commands with the privileges of the user running the Python application. The vulnerability requires user interaction (opening a file) and is fixed in version 12.3.0 and later.