Command Injection Vulnerability in Python's poplib Module
CVE-2025-15367

5.9MEDIUM

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
20 January 2026

What is CVE-2025-15367?

The poplib module in Python is vulnerable to command injection if it processes user-controlled commands without proper validation. Attackers can exploit this vulnerability by injecting additional malicious commands using newline characters. The recommended mitigation involves rejecting commands that contain control characters, enhancing the security of applications utilizing the poplib module.

Affected Version(s)

CPython 0 < 3.15.0a6

References

https://github.com/python/cpython/pull/143924
patch
https://github.com/python/cpython/issues/143923
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.