CVE-2026-0864: 
Python Interpreter vulnerability analysis and mitigation

CVE-2026-0864 is a CRLF injection vulnerability in Python's configparser standard library module that allows an attacker who controls multi-line configuration values to inject arbitrary keys and values into written configuration files by embedding carriage return characters (\r). It affects CPython versions prior to 3.15.0, with backports required for the 3.10–3.14 branches. The vulnerability was reported on January 16, 2026 by Seth Michael Larson and publicly disclosed on June 23, 2026. It carries a CVSS v4.0 base score of 4.1 (Medium) as assessed by the Python Software Foundation (Github Advisory, Feedly).

The root cause is improper neutralization of CRLF sequences (CWE-93) and special elements in output used by a downstream component (CWE-74). When configparser's _write_section() method serializes multi-line values, it previously only replaced \n with \n\t to indent continuation lines, but did not handle standalone \r (carriage return) characters. An attacker who controls the value written to a config file can embed \r followed by a new key-value pair (e.g., \rmalicious_key = malicious_value), causing the carriage return to act as a line terminator and inject a new, unintended configuration entry into the output file. The fix normalizes all line endings — \r\n, \r, and \n — to \n\t before writing, as implemented in commit 5858e42 (CPython Commit, CPython Issue).

Successful exploitation allows an attacker to tamper with the integrity of configuration files written by Python applications using configparser. By injecting arbitrary keys and values, an attacker could alter application behavior, override security-sensitive settings, or introduce malicious configuration directives that are subsequently parsed and acted upon by the application or other downstream components. There is no confidentiality or availability impact; the impact is limited to integrity of the configuration file on the local system (Github Advisory, Feedly).

1. Identify a target application: Find a Python application that uses configparser to write configuration files and accepts user-controlled or attacker-influenced input as configuration values.
2. Craft a malicious value: Prepare a string containing a carriage return character followed by a new key-value pair, e.g., legitimate_value\rinjected_key = injected_value.
3. Supply the malicious value: Provide the crafted string as a configuration value through whatever input mechanism the application exposes (e.g., a web form, API, file upload, or environment variable).
4. Trigger config file write: Cause the application to invoke configparser.write() with the attacker-controlled value, which will serialize the \r as a line terminator, placing injected_key = injected_value on a new line in the output file.
5. Achieve configuration tampering: The resulting configuration file now contains the injected key-value pair, which may be read back by the application or another process, altering behavior according to the attacker's intent (CPython Issue, CPython Commit).

• File System: Configuration files written by Python applications containing unexpected keys or values not present in the application's normal configuration logic; presence of bare \r characters or unexpected line breaks within .ini/.cfg files.
• Logs: Application logs showing unexpected configuration values being loaded or applied, particularly values that differ from what was originally set by administrators.
• Process/Application Behavior: Anomalous application behavior consistent with altered configuration settings, such as changed authentication parameters, unexpected feature flags, or modified file paths.

The Python Software Foundation has released a fix in CPython commit 5858e42, which normalizes all line endings (\r\n, \r, and \n) to \n\t when writing multi-line configparser values. Backports have been prepared for Python 3.10, 3.11, 3.12, 3.13, 3.14, and 3.15. Users should upgrade to a patched release of CPython as soon as available for their branch. As an interim workaround, applications should sanitize or validate any user-controlled input to remove or escape carriage return characters (\r) before passing values to configparser.write() (CPython Commit, Github Advisory).

The vulnerability was reported by Seth Michael Larson (PSF Security Developer-in-Residence) and disclosed via the Python security announcement mailing list. The fix was reviewed and merged by CPython core developer Petr Viktorin (encukou). No significant broader media coverage or notable community controversy has been observed, consistent with the moderate severity and limited exploitability of the issue (Python Security Announce, CPython Issue).