Audit Event Bypass in CPython FileLoader before 3.15.0
CVE-2026-2297 Published on March 4, 2026
SourcelessFileLoader does not use io.open_code()
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Vulnerability Analysis
CVE-2026-2297 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Products Associated with CVE-2026-2297
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-2297 are published in these products:
Affected Versions
Python Software Foundation CPython:- Before 3.13.13 is affected.
- Version 3.14.0 and below 3.14.4 is affected.
- Version 3.15.0a1 and below 3.15.0a7 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.