« List of all CVEs

CVE-2025-6075

Quadratic complexity in os.path.expandvars() with user-controlled template

Published: 10/31/2025 Last updated: 3/3/2026 Reserved: 6/13/2025

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

CNA assigner: PSF (28c92f92-d60d-412d-b760-e73465c3df22) Requested by: n/a

Metrics

Version Score Severity Vector String
4.0 1.8 Low CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Opam packages affected (7)

conf-python-2-7 conf-python-2-7-dev conf-python-3 conf-python-3-7 conf-python-3-dev py termbox

Products affected (0)

No product listed.

References (18)