RCE in Python Software Foundation Cpython

CVE-2025-15367

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.003 (23.8th percentile) — read the EPSS interpretation.

Affected products

Python Software Foundation Cpython — versions 0

Weakness classification (CWE)

CWE-77 — Command Injection

References

cna@python.org (patch)
cna@python.org (issue-tracking)
cna@python.org (vendor-advisory)
cna@python.org (patch)