Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceCVE-2026-42301

CVE-2026-42301

HIGH7.8

Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec

Published May 9, 2026

Modified 2 weeks ago

Details

pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1.

References

https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1

https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw

https://www.cve.org/CVERecord?id=CVE-2026-42301

CVSS Analysis

CVSS v3.1

7.8

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

7.8/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness Type (CWE)

Injection

Input Validation

Improper Input Validation

Ecosystems

Timeline

PublishedMay 9, 2026

ModifiedMay 11, 2026

CVE-2026-42301 | Mondoo Vulnerability Intelligence