The flaw lies in CPython’s import hook for legacy byte‑code files; it fails to invoke io.open_code(), preventing sys.audit handlers from firing for this import event. As a result, any code loaded from a *.pyc file can execute without generating the expected audit trail, allowing an attacker to run covert or malicious code without triggering detection mechanisms.

Python Software Foundation’s CPython implementation is affected. No specific product versions are listed, so all releases that still use the legacy import hook for legacy .pyc files are potentially vulnerable and should be treated as impacted until a fix is released.

The CVSS score of 5.7 indicates a moderate severity, with an EPSS score of less than 1 % suggesting low historical exploitation probability. The vulnerability is not currently listed in CISA’s KEV catalog. The most likely attack vector is through the local execution of malicious .pyc files or a local attacker having the ability to place such files in a location that Python will import. Once a .pyc is imported, the missing audit event means the operation can proceed silently, facilitating covert execution of arbitrary code.