CVE-2026-2297 — SourcelessFileLoader does not use io.open_code()
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read …
Published: 2026-03-04 · CVSS: 5.7 · CVSS 4.0
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7