# python 3.14.6

The Python programming language

Snapshot of gominimal/pkgs commit `02e5f823e4b55b925a4db249e262e7b4f73a96e3` (pushed 2026-07-29T21:20:39.000Z).

## Install

```sh
min add python
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| CVE-2025-15366 | MEDIUM | — | fixed | — | IMAP command injection in user-controlled commands |
| CVE-2025-15367 | MEDIUM | — | fixed | — | POP3 command injection in user-controlled commands |
| CVE-2026-0864 | MEDIUM | — | fixed | — | Configuration Injection via Carriage Return (\r) in write() method |
| CVE-2026-11940 | HIGH | — | fixed | — | tarfile extraction filter bypass allows escaping the destination directory |
| CVE-2026-11972 | HIGH | — | fixed | — | tarfile opened in streaming mode mishandles EOF |
| CVE-2026-12003 | MEDIUM | — | fixed | — | CPython >3.11 Insecure Input Validation resulting in privilege escalation |
| CVE-2026-15308 | HIGH | — | fixed | — | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations |
| CVE-2026-4360 | LOW | — | fixed | — | Tarfile.extract() doesn't fully respect filter parameter |

## Transitive advisories

2 advisories inherited through runtime dependencies:

- CVE-2026-5435 (HIGH) via glibc
- CVE-2026-6238 (MEDIUM) via glibc

## Dependencies

- Build (8): base, make, gdbm, ncurses, pkgconf, sqlite, toolchain, util-linux
- Runtime (7): bash, libffi, expat, openssl, glibc, zlib, xz

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 88 | good |
| advisories | 25 | low |
| quality | 55 | mid |
| maintenance | 100 | perfect |
| licence | 90 | good |

## Links

- Homepage: https://www.python.org
- Package page (HTML): https://minimal.dev/pkgs/python
- JSON API (floats latest): https://minimal.dev/api/pkgs/python.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/python/sbom.json