CVE-2025-15367 POP3 command injection in user-controlled commands
Attackers can inject commands into the Python poplib module via user-controlled input, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-15367?
CVE-2025-15367 is a medium-severity command injection vulnerability in CPython, published on 20 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Weakness: CWE-77
Which versions are affected by CVE-2025-15367?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.15.0 |
python Bitnami | All versions | 3.15.0 |
python-min Bitnami | All versions | 3.15.0 |
Linux distribution packages (16)
python-unversioned-command Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3 Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3-debug Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3-devel Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3-idle Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3-libs Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3-test Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3-tkinter Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3.14 Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3.14-freethreading Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3.14-freethreading-debug Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3.14-freethreading-devel Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3.14-freethreading-idle Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3.14-freethreading-libs Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3.14-freethreading-test Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
python3.14-freethreading-tkinter Red Hat:hummingbird:1 | All versions | 0:3.14.3-2.hum1 |
How do I fix CVE-2025-15367?
Upgrade libpython to 3.15.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-15367 being exploited?
There is no known exploitation of CVE-2025-15367 in the wild and no public exploit code.
Sources
Also known as AZL-75038, AZL-75050, AZL-84269, BELL-CVE-2025-15367, BIT-libpython-2025-15367, BIT-python-2025-15367 and 23 more.