Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| cheetah(PyPI) | 0.9.15 | N/A | N/A |
CVSS Metrics
