Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade epiphany | Dec 10, 2025 | Mar 11, 2009 |
| Gentoo Linux | — | Upgrade app-editors/gedit.Upgrade media-gfx/eog. | Oct 30, 2017 | Jan 27, 2009 |
| Oracle_linux | — | Upgrade pythonUpgrade python-libsUpgrade tkinterUpgrade python-toolsUpgrade python-devel | Oct 16, 2024 | Jan 28, 2009 |
| Ubuntu | — | Upgrade python2.6Upgrade python2.6-minimalUpgrade python3.1-minimalUpgrade python3.1Upgrade python2.4-minimalUpgrade python2.4Upgrade python2.5-minimalUpgrade python2.5 | Nov 8, 2024 | Jan 28, 2009 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub