The urwid web display backend constructs session identifiers by concatenating two calls to random.randrange(109), which employs Python’s Mersenne Twister PRNG, not suitable for cryptographic purposes. Each identifier leaks about 30 bits of the PRNG’s ~19,937‑bit internal state; observing roughly 334 session IDs (e.g., via the X‑Urwid‑ID HTTP response header) allows an attacker to reconstruct the internal state and predict all past and future session identifiers. The same token names a FIFO file in the world‑listable /tmp directory; any local user can enumerate active session tokens by listing /tmp. With a valid session ID an attacker can read the victim’s terminal screen, inject keystrokes (potentially executing shell commands with the session owner’s privileges if a shell is running), or flood the FIFO to terminate or crash the session. This flaw combines insecure random number generation (CWE‑338) with local enumeration of sensitive data (CWE‑1241) and enables remote code execution when the session runs a shell.

All installations of the urwid Python library that include the web display backend (urwid:urwid) are affected. No specific version constraints are provided, so any current release that has not been updated with the fix is considered vulnerable.

The CVSS score of 9.2 indicates severe confidentiality, integrity, and availability impact. The EPSS score of <1% signals a very low probability of exploitation in the near term. Exploitation requires observing session identifiers (through the X‑Urwid‑ID header or capturing traffic) or enumerating FIFO files via local /tmp access. The attack is most practical for local users or those who can intercept web traffic; no publicly documented network exploit path exists. The vulnerability is not listed in CISA’s KEV catalog.