VDB

GSD-2022-40156

GSD-2022-40156 PUBLISHED

Reported by mitre · Published April 13, 2022

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Affected products

VendorProductVersions
n/an/an/a
n/an/an/a

Timeline

  • Apr 13, 2022 CVE Published
  • Jun 9, 2023 PoC Published (44 in total, the first dated here)
  • Nov 3, 2025 CVE Updated
  • Mar 31, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GSD-2022-40156
vulnetix vdb fixes GSD-2022-40156

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GSD-2022-40156/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 10 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›