Skip to content

[3.14] gh-151544: Fixes CVE-2026-12003 by removing the fallback to %VPATH%/Modules/Setup.local for discovering sources in getpath.py (GH-151545) #151565

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
miss-islington wants to merge 4 commits into from
+14 −11
Closed

[3.14] gh-151544: Fixes CVE-2026-12003 by removing the fallback to %VPATH%/Modules/Setup.local for discovering sources in getpath.py (GH-151545) #151565

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4d228c4
gh-151544: Fixes CVE-2026-12003 by removing the fallback to %VPATH%/M…
zooba Jun 16, 2026
b76f1f9
Add argv0 setting for Python process in WASM
zooba Jun 17, 2026
b002dba
Add symlink creation for pybuilddir.txt
zooba Jun 17, 2026
c5125ff
Remove unnecessary deletion of pybuilddir.txt
zooba Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Makefile.pre.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1679,6 +1679,8 @@ Programs/_bootstrap_python.o: Programs/_bootstrap_python.c $(BOOTSTRAP_HEADERS)
_bootstrap_python: $(LIBRARY_OBJS_OMIT_FROZEN) Programs/_bootstrap_python.o Modules/getpath.o Modules/Setup.local
$(LINKCC) $(PY_LDFLAGS_NOLTO) -o $@ $(LIBRARY_OBJS_OMIT_FROZEN) \
Programs/_bootstrap_python.o Modules/getpath.o $(LIBS) $(MODLIBS) $(SYSLIBS)
# Dummy pybuilddir.txt is needed for _bootstrap_python to be runnable
@echo "none" > ./pybuilddir.txt
Comment thread
zooba marked this conversation as resolved.


############################################################################
Expand Down
4 changes: 4 additions & 0 deletions Misc/NEWS.d/next/Security/2026-06-16-14-58-02.gh-issue-151544._bexVy.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
:file:`Modules/Setup.local` is no longer used as a landmark to discover
whether Python is running in a source tree, as it could potentially affect
actual installs. The :file:`pybuilddir.txt` file is now the sole indicator
of running in a source tree.
15 changes: 4 additions & 11 deletions Modules/getpath.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,8 +129,7 @@
# checked by looking for the BUILDDIR_TXT file, which contains the
# relative path to the platlib dir. The executable_dir value is
# derived from joining the VPATH preprocessor variable to the
# directory containing pybuilddir.txt. If it is not found, the
# BUILD_LANDMARK file is found, which is part of the source tree.
# directory containing pybuilddir.txt.
# prefix is then found by searching up for a file that should only
# exist in the source tree, and the stdlib dir is set to prefix/Lib.

Expand Down Expand Up @@ -177,7 +176,6 @@

if os_name == 'posix' or os_name == 'darwin':
BUILDDIR_TXT = 'pybuilddir.txt'
BUILD_LANDMARK = 'Modules/Setup.local'
DEFAULT_PROGRAM_NAME = f'python{VERSION_MAJOR}'
STDLIB_SUBDIR = f'{platlibdir}/python{VERSION_MAJOR}.{VERSION_MINOR}{ABI_THREAD}'
STDLIB_LANDMARKS = [f'{STDLIB_SUBDIR}/os.py', f'{STDLIB_SUBDIR}/os.pyc']
Expand All @@ -190,7 +188,6 @@

elif os_name == 'nt':
BUILDDIR_TXT = 'pybuilddir.txt'
BUILD_LANDMARK = f'{VPATH}\\Modules\\Setup.local'
DEFAULT_PROGRAM_NAME = f'python'
STDLIB_SUBDIR = 'Lib'
STDLIB_LANDMARKS = [f'{STDLIB_SUBDIR}\\os.py', f'{STDLIB_SUBDIR}\\os.pyc']
Expand Down Expand Up @@ -512,13 +509,9 @@ def search_up(prefix, *landmarks, test=isfile):
platstdlib_dir = real_executable_dir
build_prefix = joinpath(real_executable_dir, VPATH)
except (FileNotFoundError, PermissionError):
if isfile(joinpath(real_executable_dir, BUILD_LANDMARK)):
build_prefix = joinpath(real_executable_dir, VPATH)
if os_name == 'nt':
# QUIRK: Windows builds need platstdlib_dir to be the executable
# dir. Normally the builddir marker handles this, but in this
# case we need to correct manually.
platstdlib_dir = real_executable_dir
# We used to check for an alternate landmark here, but now we require
# BUILDDIR_TXT to exist. (gh-151544; CVE-2026-12003)
pass

if build_prefix:
if os_name == 'nt':
Expand Down
4 changes: 4 additions & 0 deletions Tools/wasm/wasi/__main__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -368,6 +368,10 @@ def configure_wasi_python(context, working_dir):
file.write(f'#!/bin/sh\nexec {host_runner} {python_wasm} "$@"\n')
exec_script.chmod(0o755)
log("🏃", f"Created {exec_script} (--host-runner)... ")
pybuilddir_txt = working_dir / "pybuilddir.txt"
if not pybuilddir_txt.exists():
os.symlink(CHECKOUT / "pybuilddir.txt", pybuilddir_txt)
log("📝", f"Symlinked {pybuilddir_txt} to normal location")
Comment on lines +371 to +374

@zooba zooba Jun 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@savannahostrowski @brettcannon Without the ../../Modules/Setup.local fallback (the security risk I'm fixing here) and without the --argv0 argument to fix up the path (not available in this version of wasmtime), this seems to be the best way to help it find pybuilddir.txt. Any thoughts/comments?

@brettcannon brettcannon Jun 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not available in this version of wasmtime

The wasmtime version isn't locked, so you should be able to update it (might need CLI updates because there was a change to the format at some point).

@zooba zooba Jun 19, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Making this change (#151682) works, but I have no idea what the added effects may be, e.g. how easily can someone doing builds of 3.14 figure out that they need to update their wasmtime after the --argv0 argument causes it to fail? Any other risks in backporting the version upgrade that wouldn't show up in CI?

@brettcannon brettcannon Jun 19, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • --argv0 was added in wasmtime 24 (Aug 2024), which is the oldest version still receiving releases and predates CPython 3.14.0 (and 3.13.0)
  • Users of wasmtime should be updating for security fixes regularly
  • wasmtime is typically very backwards-compatible
  • People can update any build script by setting --host-runner for their preferred command to run their preferred WASI host

So I say it's say to update the default host runner settings.

sys.stdout.flush()


Expand Down
Loading