CVE-2026-0864 — Configuration Injection via Carriage Return (\r) in write() method
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected wit…
Published: 2026-06-23 · CVSS: 4.1 · CVSS 4.0
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7