Detections
Analytics

Echo: python3.13: security update to 3.13.5-2+e35

medium Tenable Cloud Security Plugin ID 458656

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The tarfile module's tar and data extraction filters created directories outside the destination for
 members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The
 containment check used the resolved path, but intermediate directories were created from the name as
 given. Only empty directories are created outside the destination. Member contents are still extracted
 inside it. To return to the destination the member's name must contain the destination directory's own
 final component, so extraction into a secure randomised directory is not affected. This affects POSIX
 platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the
 directories outside the destination are never created. (CVE-2026-19672)

Solution

Update the python3.13 library and its related packages to version 3.13.5-2+e35 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-19672

Plugin Details

Severity: Medium

ID: 458656

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-19672

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/27/2026

Vulnerability Publication Date: 8/19/2026

Reference Information

CVE: CVE-2026-19672