Skip to content
Heist/ feed
MediumFix available

tarfile hardlink fallback ignores custom extraction filter rejection via None

Type: advisorySource: OSVRisk context updated1 source record

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

Announced Source revision 2
Original source ↗
CVE context updated. The publisher announcement is unchanged.

BIT-python-min-2026-87910

Primary source · Revision 2

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-python-min-2026-87910

python-min

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
3.10.22

Source reference: /affected/0/ranges

3.11.17

Source reference: /affected/0/ranges

3.12.15

Source reference: /affected/0/ranges

3.13.16

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.10.22"
          },
          {
            "introduced": "3.11.0"
          },
          {
            "fixed": "3.11.17"
          },
          {
            "introduced": "3.12.0"
          },
          {
            "fixed": "3.12.15"
          },
          {
            "introduced": "3.13.0"
          },
          {
            "fixed": "3.13.16"
          },
          {
            "introduced": "3.14.0"
          }
        ]
      }
    ],
    "package": {
      "name": "python-min",
      "purl": "pkg:bitnami/python-min",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V4",
        "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-87910.json"
    }
  }
]
Related CVEs
CVE-2026-87910

Source reference: /aliases

Publisher severity

medium

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-87910 · Medium

CPython

CVE-2026-87910 · Medium

libpython

CVE-2026-87910 · Medium

python

Event
#84069 · Revision 2
Added to Heist Feed
Publisher date
Read the original announcement