GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.15] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (GH-161706) by miss-islington · Pull Request #161717 · python/cpython

Conversation

@miss-islington

@miss-islington miss-islington commented Nov 9, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

  • Add sys._path0 variable.
  • pymain_sys_path_add_path0() sets sys._path0.
  • Add runpy._remove_sys_path0().
  • gzip, tarfile and zipfile main functions now call
    _remove_sys_path0() to prevent shadowing stdlib modules from
    extracted files.
    (cherry picked from commit e891a91)

Co-authored-by: Victor Stinner [email protected]
Co-authored-by: Gregory P. Smith [email protected]
Co-authored-by: Ethan Furman [email protected]
Co-authored-by: Kirill Podoprigora [email protected]

  • Issue: [security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791] #161705

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@vstinner @gpshead
@ethanfurman @Eclips4 @miss-islington
pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (…
169e65f 
…pythonGH-161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.
(cherry picked from commit e891a9117985888df3e5d48145cf07ddda098335)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Ethan Furman <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
@miss-islington
miss-islington requested review from FFY00, ericsnowcurrently and ethanfurman as code owners November 9, 2026 23:49
@bedevere-app bedevere-app Bot mentioned this pull request Nov 9, 2026
gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI #161706
Merged
@bedevere-app bedevere-app Bot added the type-security A security issue label Nov 9, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Nov 9, 2026
[security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791] #161705
Open
@bedevere-app bedevere-app Bot added the awaiting review label Nov 9, 2026
@read-the-docs-community

read-the-docs-community Bot commented Nov 9, 2026

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35770949 | 📁 Comparing 169e65f against main (e891a91)

  🔍 Preview build  

166 files changed · + 1 added · ± 160 modified · - 5 deleted

+ Added

  • library/asyncio-policy.html

± Modified

  • index.html
  • license.html
  • py-modindex.html
  • builtins/exceptions.html
  • builtins/functions.html
  • builtins/stdtypes.html
  • builtins/threadsafety.html
  • c-api/bytes.html
  • c-api/capsule.html
  • c-api/code.html
  • and 150 more...

- Deleted

  • deprecations/pending-removal-in-3.21.html
  • library/tkinter.dialogs.html
  • library/tkinter.fontchooser.html
  • library/tkinter.systray.html
  • whatsnew/3.16.html
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner
vstinner enabled auto-merge (squash) November 9, 2026 23:59
@vstinner
vstinner merged commit 673607e into python:3.15 Nov 10, 2026
61 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting review label Nov 10, 2026
@miss-islington
miss-islington deleted the backport-e891a91-3.15 branch November 10, 2026 00:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner
@ericsnowcurrently ericsnowcurrently Awaiting requested review from ericsnowcurrently ericsnowcurrently is a code owner
@FFY00 FFY00 Awaiting requested review from FFY00 FFY00 is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@miss-islington @vstinner
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.