Vulnerability DatabaseWS-2026-0180
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
WS-2026-0180
Published:November 03, 2026
Updated:November 06, 2026
CPython 3.11.0a7 through 3.11.18, 3.12.x through 3.12.16, 3.13.x before 3.13.16, 3.14.x before 3.14.8 and 3.15.0 pre-releases before 3.15.0rc2 index out of bounds in _Py_subs_parameters() (Objects/genericaliasobject.c) when an argument gains __typing_subst__ after a GenericAlias has cached its __parameters__. Release builds read argitems[-1], which crashes the interpreter and has been shown to let template code escape the Jinja2 sandbox. 3.11 and 3.12 receive no fix.
Affected Packages
python (CONDA):
Affected version(s) >=3.14.0rc1 <3.14.8
Fix Suggestion:
Update to version 3.14.8
cpython (CONDA):
Affected version(s) >=3.15.0a2 <3.15.0
Fix Suggestion:
Update to version 3.15.0
cpython (CONDA):
Affected version(s) >=3.14.0rc1 <3.14.8
Fix Suggestion:
Update to version 3.14.8
python (CONDA):
Affected version(s) >=3.15.0a2 <3.15.0
Fix Suggestion:
Update to version 3.15.0
cpython (CONDA):
Affected version(s) >=3.13.0rc1 <3.13.16 || >=3.11.10 <3.13.16 || >=3.12.6 <3.13.16
Fix Suggestion:
Update to version 3.13.16
python (CONDA):
Affected version(s) >=3.13.0rc1 <3.13.16 || >=3.11.0 <3.13.16 || >=3.12.0rc2 <3.13.16
Fix Suggestion:
Update to version 3.13.16
https://github.com/python/cpython.git (GITHUB):
Affected version(s) >=v3.14.0a1 <v3.14.8
Fix Suggestion:
Update to version v3.14.8
https://github.com/python/cpython.git (GITHUB):
Affected version(s) >=v3.15.0a1 <v3.15.0
Fix Suggestion:
Update to version v3.15.0
https://github.com/python/cpython.git (GITHUB):
Affected version(s) >=v3.11.0a7 <v3.13.16 || >=v3.12.0a1 <v3.13.16 || >=v3.13.0a1 <v3.13.16
Fix Suggestion:
Update to version v3.13.16
Related Resources (7)
https://github.com/python/cpython/issues/155752
https://github.com/python/cpython/pull/155772
https://www.runsybil.com/blog/cpython-0-day-vulnerabilities-threaten-the-ai-supply-chain
https://github.com/python/cpython/pull/155761
https://github.com/python/cpython/pull/155770
https://github.com/python/cpython/pull/155771
https://seclists.org/oss-sec/2026/q4/530
Do you need more information?
Contact Us
CVSS v4
Base Score:
9
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
CVSS v3
Base Score:
8.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Validation of Array Index
CWE-129