CVE-2026-2297: SourcelessFileLoader does not use io.open_code()
SourcelessFileLoader does not use io.opencode()
Other sources
The import hook in CPython that handles legacy .pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.opencode() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2297?
CVE-2026-2297 has been classified as a moderate severity vulnerability affecting Python CPython.
How do I fix CVE-2026-2297?
To fix CVE-2026-2297, update your Python CPython installation to the latest version where the vulnerability has been patched.
What software is affected by CVE-2026-2297?
CVE-2026-2297 affects Python CPython without specific version restrictions.
What type of vulnerability is CVE-2026-2297?
CVE-2026-2297 is a vulnerability related to improper handling of legacy .pyc files in the SourcelessFileLoader module.
Does CVE-2026-2297 affect all users of Python CPython?
Yes, CVE-2026-2297 potentially affects all users of Python CPython who utilize the affected modules for loading source code.