PYSEC-2026-622

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/cheetah/PYSEC-2026-622.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-622

Aliases

CVE-2005-1632
GHSA-vxf2-7rc3-pxmx

Published

2026-07-02T14:13:19.492605Z

Modified

2026-07-06T08:00:10.395718009Z

Summary

Cheetah Path Search Order Hijacking

Details

Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.

References

https://nvd.nist.gov/vuln/detail/CVE-2005-1632
https://github.com/cheetahtemplate/cheetah
https://web.archive.org/web/20050430021153/http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542
https://pypi.org/project/cheetah
https://github.com/advisories/GHSA-vxf2-7rc3-pxmx

Affected packages

PyPI / cheetah

Package

Name: cheetah; View open source insights on deps.dev
Purl: pkg:pypi/cheetah

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.9.15

Last affected

0.9.16

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/cheetah/PYSEC-2026-622.yaml"