In Python 3 through 3.9.0, the Lib/test/multibytecodecsupport.py CJK codec tests call eval() on content retrieved via HTTP.
The affected code is in Python's CJK codec test support module, Lib/test/multibytecodec_support.py. Exposure therefore applies when these tests are run in affected Python versions and retrieve content over HTTP.
An attacker needs to control or tamper with HTTP content retrieved by the CJK codec tests. That content is passed to eval(), which can execute attacker-supplied Python expressions.
The provided information identifies the vulnerable behavior in a test support module and specifically during CJK codec tests. It does not establish exposure for normal application execution outside of those tests.
Check whether your environment runs CJK codec tests using Lib/test/multibytecodec_support.py and whether those tests retrieve data via HTTP. Python versions from 3 through 3.9.0 are identified as affected.