Prior to version 1.2.2, python-dotenv’s set_key and unset_key functions follow symbolic links when rewriting .env files, enabling a local attacker to overwrite arbitrary files on the same device through a crafted symlink when a cross‑device rename fallback is triggered. This file‑write flaw can lead to modification of critical configuration files or other sensitive data, potentially resulting in privilege escalation or remote code execution if exploited against executable or configuration files.

The vulnerability affects all installations of the theskumar python-dotenv library released before version 1.2.2. Any deployment that has not applied the upstream patch (as referenced by the commit and release notes) remains susceptible.

With a CVSS score of 6.6 the vulnerability is considered moderate. The exploit requires local write access to the .env file and the ability to trigger a rewrite operation; EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Because the attack relies on a local file‑write weakness (CWE‑59) and symbolic‑link traversal (CWE‑61), the risk is mitigated by restricting write permissions on .env files and by applying the official fix.