What’s Vulnerable › Vulnerabilities

CVE-2019-13404

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-08 · updated 2026-06-17
• Weakness: CWE-552

Description

The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x

Affected products

• Python: through 2.7.16; from 3.0.0 before 3.5.0 — fixed in 3.5.0

How to fix

Upgrade to a fixed version: Python 3.5.0. Check the vendor advisory for mitigations.

References

• https://docs.python.org/2/faq/windows.html
• https://docs.python.org/2/faq/windows.html

Get alerted when CVE-2019-13404 or the next vulnerability affects your stack