In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file.

Summary

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Timeline

1. Apr 13, 2022, 12:00 AM UTCCVE published
2. Oct 7, 2026, 9:22 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 14, 2026, 6:25 AM UTCRecord last updated

Affected versions

No affected packages have been listed by the sources.

References 25