CVE-2020-15801

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2020
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-158025.9Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core CVE-2020-158036.1Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Wi CVE-2020-158067.5CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.CVE-2020-158076.5GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.CVE-2020-158096.5spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP3 CVE-2020-15817.8An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) components handle objects in memory. An a CVE-2020-158106.5An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succ CVE-2020-158116.5An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succ CVE-2020-158138.1Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The CVE-2020-158168.8In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute c CVE-2020-158178.8In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.CVE-2020-158185.3In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.