CVE-2008-5983

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-28 · updated 2026-06-16
Weakness: CWE-426

Description

Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

Affected products

Canonical Ubuntu Linux: 8.04, 10.04, 11.04, 11.10
Fedoraproject Fedora: 13
Python: before 2.6.6; from 3.1.0 before 3.1.3 — fixed in 2.6.6, 3.1.3

How to fix

Upgrade to a fixed version: Python 2.6.6, 3.1.3. Check the vendor advisory for mitigations.

References

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.html
http://secunia.com/advisories/34522
http://secunia.com/advisories/40194
http://secunia.com/advisories/42888
http://secunia.com/advisories/50858
http://secunia.com/advisories/51024
http://secunia.com/advisories/51040
http://secunia.com/advisories/51087
http://security.gentoo.org/glsa/glsa-200903-41.xml
http://security.gentoo.org/glsa/glsa-200904-06.xml
http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg586010.html
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Get alerted when CVE-2008-5983 or the next vulnerability affects your stack