GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791] · Issue #161705 · python/cpython

[security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791] #161705

New issue
Copy link
New issue
Copy link
Open
Open
[security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791]#161705
Copy link
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue

Description

@vstinner
vstinner
opened on Nov 9, 2026
Issue body actions

When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory.

Linked PRs

  • gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI #161706
  • [3.15] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (GH-161706) #161717
  • [3.14] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706) #161719
  • [3.13] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706) (#161719) #161726
  • [3.12] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI #161727
  • [3.11] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI #161728

Activity

  1. vstinner
    added
    type-securityA security issueA security issue
    on Nov 9, 2026
  2. Eclips4
    added
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    3.11only security fixesonly security fixes
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.15bugs and security fixesbugs and security fixes
    3.16new features, bugs and security fixesnew features, bugs and security fixes
    on Nov 9, 2026
  3. vstinner
    added 3 commits that reference this issue on Nov 9, 2026

    gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706

    e891a91

    [3.15] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (

    673607e

    [3.14] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (

    8aa5d65
  4. orsenthil
    added a commit that references this issue on Nov 12, 2026

    pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (…

    c86d549
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.