CPython gzip, tarfile, and zipfile CLIs can shadow stdlib (CVE-2026-115791)
Original title: CPython: [CVE-2026-115791] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI
Python's security list rates the flaw medium; the excerpt gives no fixed version or exploitation status.
A notice forwarded to oss-security describes a medium-severity CPython flaw, CVE-2026-115791, in the gzip, tarfile, and zipfile command-line interfaces. The subject says the issue can shadow the standard library when those CLIs are used. The available text ends before stating the full trigger, affected releases, or a fix.
Unconfirmed: The excerpt does not state affected versions, the fix, or whether the flaw is exploited.
- Victor Stinner sent the notice on Nov. 10.
- Alan Coopersmith forwarded it to oss-security the same day.
- The announcement labels the issue medium severity.
- Affected and fixed versions are not in the excerpt.
Impact: standard-library shadowing via gzip, tarfile, or zipfile CLI
| Product | Affected |
|---|---|
| Python CPython | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115791 | Stdlib module shadowing in CPython tarfile/zipfile CLI | 5.3 | — |
From the original article
Posted by Alan Coopersmith on Nov 10 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-115791] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI Date: Tue, 10 Nov 2026 17:00:26 +0100 From: Victor Stinner Reply-To: security-sig () python org To: security-announce () python org There is a MEDIUM severity vulnerability affecting CPython.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.