Technical impact
When CPython’s configparser module writes configuration files containing multi‑line text that include carriage return characters (\r), the written file can be injected with unexpected keys and values if an attacker supplies the value. This vulnerability essentially allows the attacker to alter configuration data that the target application will later read, potentially changing application settings, disabling security controls, or redirecting logic paths. The weakness is an example of configuration injection (CWE‑74 and CWE‑93).
Affected Systems
All CPython implementations that use the standard library’s configparser.write routine to generate configuration files containing values with carriage return characters are potentially affected. No specific CPython release is isolated in the advisory, so all current and recent releases that have not yet received the patch commit 5858e42c5 are considered vulnerable.
Risk and Exploitability
The CVSS score of 4.1 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. No EPSS metric is available, but the likelihood of exploitation is limited to environments where an attacker can influence the data written to a configuration file—typically local or application‑level scenarios. No publicly known exploits have been reported, suggesting the exploitability remains low and dependent on trusted input being written to disk.
