[CVE-2026-3479] Documented pkgutil.get_data() restrictions are not enforced #146121
Description
Metadata
Metadata
Assignees
Labels
only security fixesonly security fixesonly security fixesonly security fixesonly security fixesonly security fixesbugs and security fixesbugs and security fixesbugs and security fixesbugs and security fixespre-release feature fixes, bugs and security fixespre-release feature fixes, bugs and security fixesStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directoryA security issueA security issue
Fields
Give feedbackNo fields configured for issues without a type.
Projects
StatusShow more project fields
Please see PR for more information.
The PSRT has decided to treat this as a security issue since this was a documented restriction.
Linked PRs
pkgutil.get_data()reject invalid resource arguments #146122pkgutil.get_data()reject invalid resource arguments (GH-146122) #146133pkgutil.get_data()reject invalid resource arguments (GH-146122) #146134pkgutil.get_data()reject invalid resource arguments (GH-146122) #146135pkgutil.get_data()reject invalid resource arguments (GH-146122) #146136pkgutil.get_data()reject invalid resource arguments (GH-146122) #146137