CVE-2020-15801
criticalIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations.
Vendor / product: Python — python
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2020-07-17 03:15
Modified: 2026-10-14 10:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
python / python ≥3.7.0 <3.7.9, ≥3.8.0 <3.8.5
netapp / max_data all versions
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://bugs.python.org/issue41304
Vendor advisory: https://github.com/python/cpython/pull/21495
Vendor advisory: https://bugs.python.org/issue41304
Vendor advisory: https://github.com/python/cpython/pull/21495
Patch / mitigation: https://bugs.python.org/issue41304
Patch / mitigation: https://github.com/python/cpython/pull/21495
Patch / mitigation: https://bugs.python.org/issue41304
Patch / mitigation: https://github.com/python/cpython/pull/21495
References
- https://bugs.python.org/issue41304 cve@mitre.org
- https://github.com/python/cpython/pull/21495 cve@mitre.org
- https://security.netapp.com/advisory/ntap-20200731-0003/ cve@mitre.org
- https://bugs.python.org/issue41304 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/python/cpython/pull/21495 af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20200731-0003/ af854a3a-2127-422b-91ae-364da2661108
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗