PyPI/web2py CVE-2016-3953: critical 9.8, EPSS 3.34%

web2py remote code execution via hardcoded encryption key in session.connect function

Action: Upgrade web2py to 2.14.2 or later.

pip install web2py==2.14.2

Affected

Fixed versions

Sources

• osv: PYSEC-2026-570
• https://nvd.nist.gov/vuln/detail/CVE-2016-3953
• https://github.com/web2py/web2py/issues/1205
• https://github.com/web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40
• https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957
• https://github.com/web2py/web2py
• https://github.com/web2py/web2py/blob/R-2.14.1/applications/examples/models/session.py
• https://usn.ubuntu.com/4030-1
• https://pypi.org/project/web2py
• https://github.com/advisories/GHSA-q2rq-qgcf-m22w

CVE-2016-3953 · published 2026-06-29T11:50:32.809887Z · modified 2026-07-01T20:23:11.781906Z · JSON