CVE-2009-0367
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the...
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
Exploit likelihood
What each source reports
NVD Score used
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
- Record
CVE-2009-0367- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
- Record
CVE-2009-0367- Updated
- 2026-11-02
EUVDEUVD-2009-0371 No score
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
- Record
EUVD-2009-0371- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hmxr-rwh4-hh58 No score
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the...
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
- Record
GHSA-hmxr-rwh4-hh58- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Wesnoth 1.x - PythonAI Remote Code Execution | 2009-02-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0367 is a high vulnerability (CVSS 9.3) in Wesnoth, published March 5, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.9%, the 95th percentile. No source names a fixed version.
References
launchpad.net/bugs/336396
packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog
gna.org/bugs/index.php?13048
exchange.xforce.ibmcloud.com/vulnerabilities/49058
wesnoth.org/forum/viewtopic.php?t=24340
Show 9 moreShow less
secunia.com/advisories/34058
vupen.com/english/advisories/2009/0595
debian.org/security/2009/dsa-1737
nvd.nist.gov/vuln/detail/CVE-2009-0367
github.com/advisories/GHSA-hmxr-rwh4-hh58