{"action":"The 3.16.x fix (3.16.0) is not released yet.","affected":[{"fixed":"3.16.0","introduced":"0"}],"component":"python","cve_ids":["CVE-2026-19672"],"ecosystem":"python","exploited":false,"fixed_versions":["3.16.0"],"id":"tcs_01M5JTNATRG9KM0AN1Y0V78RFC","modified_at":"2026-08-19T15:24:08Z","published_at":"2026-08-19T15:24:08Z","references":["https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-38.json","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://www.cve.org/CVERecord?id=CVE-2026-19672"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"python-runtime","source_id":"PSF-2026-38","url":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-38.json"}],"summary":"tarfile extraction filter bypass allows creation of directories outside the destination"}