UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15801

In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.

Severity
Critical 9.8
Published
17 Jul 2020
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.7.9, 3.8.5
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • From 3.7.0 before 3.7.9
  • From 3.8.0 before 3.8.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15801
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15801