CVE-2022-0391

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Feb 9, 2022
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03927.8Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.CVE-2022-03937.1Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.CVE-2022-03945.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03955.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03965.3BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted CVE-2022-03975.4The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it bac CVE-2022-03985.4The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affili CVE-2022-03996.1The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter be CVE-2022-04007.5An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.CVE-2022-04019.8Path Traversal in NPM w-zip prior to 1.0.12.CVE-2022-04026.1The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana param CVE-2022-04038.1The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by