Vulnerability in Python Software Foundation Cpython
CVE-2026-2297
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
EPSS: 0.002 (10.4th percentile) — read the EPSS interpretation.
Affected products
- Python Software Foundation Cpython — versions 3.14.0, 0, 3.13.0
Weakness classification (CWE)
References
- cna@python.org (issue-tracking)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- af854a3a-2127-422b-91ae-364da2661108
- cna@python.org (patch)