CVE-2025-15367

Aliases:RHSA-2026:5994UBUNTU-CVE-2025-15367DEBIAN-CVE-2025-15367CGA-3h86-qrh3-64w8CGA-5336-j8mr-r6g4CGA-8fx3-25f8-fh5xCGA-c39r-w42m-w4vjCGA-ch3p-52mr-p765CGA-ffmr-pm2v-8xqwCGA-fhp9-r9rg-wpv2CGA-h68m-5fcm-3cwxCGA-cx2g-r55q-44rgCGA-v93h-6cpg-xvxgCGA-wx55-qrwh-xc7rCGA-xwgm-4f5v-v3xw
Advisory lineage Upstream: 0 Downstream: 54
Deferred
Published: 20 Jan 2026, 21:47
Last modified:26 Feb 2026, 14:44

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.9 MEDIUM
v4.0 (cve.org)
EPSS Score
0.37% LOW
0% probability +0.29%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Jan 2026, 21:47
Published
Vulnerability first disclosed
26 Feb 2026, 14:44
Last Modified
Vulnerability information updated

Description

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
  • v4.0•MEDIUM•Score: 5.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

EPSS Trends

Current EPSS score: 0.37%• Percentile: 31%

Techniques & Countermeasures

  • CWE-77•Improper Neutralization of Special Elements used in a Command ('Command Injection')

    The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected Systems

  • chainguard•python-3.10

    all

  • chainguard•python-3.11

    all

  • chainguard•python-3.12

    all

  • chainguard•python-3.13

    all

  • chainguard•python-3.14

    all

  • chainguard•python-3.9

    all

  • wolfi•python-3.10

    all

  • wolfi•python-3.11

    all

  • wolfi•python-3.12

    all

  • wolfi•python-3.13

    all

  • wolfi•python-3.14

    all

  • debian•jython

    all | all | all | all

  • debian•pypy3

    all | all | all | all

  • debian•python2.7

    all

  • debian•python3.11

    all

  • debian•python3.13

    all | all

  • debian•python3.14

    all

  • debian•python3.9

    all

  • ubuntu•python2.7

    all | all

  • ubuntu•python3.10

    all

  • ubuntu•python3.11

    all

  • ubuntu•python3.12

    all

  • ubuntu•python3.13

    all

  • ubuntu•python3.14

    all

  • ubuntu•python3.4

    all

  • ubuntu•python3.5

    all

  • ubuntu•python3.6

    all

  • ubuntu•python3.7

    all

  • ubuntu•python3.8

    all

  • ubuntu•python3.9

    all

  • python software foundation•cpython

    < 3.15.0 | < 3.15.0a6

  • redhat•python-unversioned-command

    < 0:3.14.3-2.hum1

  • redhat•python3

    < 0:3.14.3-2.hum1

  • redhat•python3.14

    < 0:3.14.3-2.hum1

References (19)