The python-dotenv library, used to read and set environment variables from .env files, contained a vulnerability (CVE-2026-28684) in versions before 1.2.2. The set_key() and unset_key() functions improperly follow symbolic links when rewriting .env files, enabling a local attacker to overwrite arbitrary files via a crafted symlink. This occurs specifically when a cross-device rename fallback is triggered. The vulnerability is categorized under CWE-59 (Improper Link Resolution Before File Access) and CWE-61. The issue was addressed in version 1.2.2.

The vulnerability allows a local attacker with limited privileges to overwrite arbitrary files on the filesystem by exploiting symbolic link following during .env file updates. This can lead to integrity and availability impacts, such as modifying critical files or disrupting application behavior. There is no direct confidentiality impact reported. The CVSS 3.1 score is 6.6 (medium severity), reflecting the need for user interaction and local access.

Users should upgrade python-dotenv to version 1.2.2 or later, where this vulnerability is fixed. If upgrading is not immediately possible, users can manually apply the patch to prevent symbolic link following during .env file rewriting. No vendor advisory was provided, so patch status is inferred from the version information in the description.