The vulnerability in CPython's configparser module arises when multi-line text values containing carriage return characters (\r) are written to configuration files. This can lead to injection of unexpected keys and values if an attacker controls the input value. The issue is tracked as CVE-2026-0864 and affects versions before 3.15.0, including 3.14.0 and 3.15.0a1. The CVSS 4.1 score reflects a medium severity with local attack vector, low attack complexity, and partial privileges required. No known exploits are reported in the wild, and no official fix or patch has been published as of the data provided.

An attacker with the ability to control the value written by configparser can inject unexpected keys and values into configuration files. This could potentially alter application behavior or configuration in unintended ways. The impact requires local access with partial privileges and user interaction, limiting the scope of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid writing multi-line configuration values containing carriage return characters (\r) with configparser if those values can be influenced by untrusted sources. Review and sanitize inputs used in configuration files to prevent injection of unexpected keys and values.