pkgutil.get_data() does not enforce documented restrictions

Open Source Vulnerabilities CVE-2026-3479

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.

Open Source Vulnerabilities PSF-2026-13

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.

Open Source Vulnerabilities BIT-python-min-2026-3479

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.

Open Source Vulnerabilities BIT-python-2026-3479

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.

Open Source Vulnerabilities BIT-libpython-2026-3479

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.