Skip to content
Fencer Vulns
medium 5.4

CVE-2025-50817 json

Withdrawn Advisory: Python-Future Module Arbitrary Code Execution via Unintended Import of test.py

published 2025-08-14 14 mo ago modified 2026-09-10 1 mo ago also GHSA-xqrq-4mgf-ff32 , EUVD-2025-24871

cvss
5.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code. NOTE: Multiple third parties have disputed this issue and stated that it is not a security flaw in python-future and is a documented feature of Python’s import system in the handling of sys.path.

Patch / fix

  • python-future SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +18 more 0.18.2-150300.3.6.1
  • python-future SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 0.18.3-150400.6.6.1
  • python-future SLE Module for Public Cloud 12 0.15.2-3.6.1
  • python-future SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 0.15.2-3.8.1

suse advisories SUSE-SU-2025:03049-1SUSE-SU-2025:03038-1SUSE-SU-2025:03029-1SUSE-SU-2025:03028-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-50817 updated cvss 7.3

pypi-future: Python future unintended import

  • Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-istio-controller-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9, openshift-service-mesh/istio-sail-operator-bundle, +1 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/ansible-dev-tools-rhel8, ansible-automation-platform-25/ee-dellemc-openmanage-rhel8, ansible-automation-platform-25/aap-cloud-metrics-collector-rhel8, ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 Red Hat OpenShift Container Platform 4 future Red Hat OpenStack Platform 16.2 python3-future Red Hat OpenStack Platform 17.1 python3-future
    +1 more products
    Red Hat OpenStack Platform 18.0 future
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
14 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CNA 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.