Medium · published June 23, 2026
When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value.
| Product | Versions | Fixed in |
|---|---|---|
| python/python | < 3.10.21 | 3.10.21 |
| python/python | ≥ 3.11.0, < 3.11.16 | 3.11.16 |
| python/python | ≥ 3.12.0, < 3.12.14 | 3.12.14 |
| python/python | ≥ 3.13.0, < 3.13.15 | 3.13.15 |
| python/python | ≥ 3.14.0, < 3.14.7 | 3.14.7 |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |
| python/python | all versions | — |