CVE-2008-5983
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier,...
CVE-2008-5983 is a medium vulnerability (CVSS 6.9) in Python, published January 28, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in python 0:2.4.3-43.el5.
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
Exploit likelihood
What each source reports
NVD Score used
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
- Record
CVE-2008-5983- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-426
- Updated
- 2026-11-02
CVE List No score
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
- Record
CVE-2008-5983- Updated
- 2026-11-02
EUVDEUVD-2008-5953 No score
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
- Record
EUVD-2008-5953- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4jhg-wfq8-3vgm No score
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier,...
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
- Record
GHSA-4jhg-wfq8-3vgm- Weakness
- CWE-426
- Updated
- 2026-11-02
OSVAZL-109584 No score
CVE-2008-5983 affecting package python-py 1.11.0-1
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
- Record
AZL-109584- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-pyAzure Linux:3 |
through 1.11.0-1 | None known |
pythonRed Hat:enterprise_linux:5::client_workstation |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
python-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
python-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
pythonRed Hat:enterprise_linux:5::client |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
python-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
python-libsRed Hat:enterprise_linux:5::client |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
python-toolsRed Hat:enterprise_linux:5::client |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
tkinterRed Hat:enterprise_linux:5::client |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
pythonRed Hat:enterprise_linux:5::server |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
python-develRed Hat:enterprise_linux:5::server |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
python-libsRed Hat:enterprise_linux:5::server |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
python-toolsRed Hat:enterprise_linux:5::server |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
tkinterRed Hat:enterprise_linux:5::server |
before 0:2.4.3-43.el5 | 0:2.4.3-43.el5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
mail-archive.com/debian-bugs-dist%40lists.debian.org/msg586010.html
bugzilla.redhat.com/show_bug.cgi?id=482814
lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.html
secunia.com/advisories/51087
openwall.com/lists/oss-security/2009/01/30/2
ubuntu.com/usn/USN-1616-1
Show 49 moreShow less
security.gentoo.org/glsa/glsa-200903-41.xml
vupen.com/english/advisories/2010/1448
nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
redhat.com/support/errata/RHSA-2011-0027.html
nvd.nist.gov/vuln/detail/CVE-2008-5983
github.com/advisories/GHSA-4jhg-wfq8-3vgm
access.redhat.com/errata/RHSA-2011:0027
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0027.json
cve.org/CVERecord?id=CVE-2008-5983