CVE-2026-2297
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.7
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.21%
- Published
- 2026-03-04
- Last modified
- 2026-09-14
Affected products
- Python Software Foundation CPython
- Python Software Foundation CPython
- Python Software Foundation CPython
- Python Software Foundation CPython
- Python Software Foundation CPython
- Python Software Foundation CPython