{"action":"The 3.16.x fix (3.16.0) is not released yet.","affected":[{"fixed":"3.16.0","introduced":"0"}],"component":"python","cve_ids":["CVE-2026-114583"],"ecosystem":"python","exploited":false,"fixed_versions":["3.16.0"],"id":"tcs_01M5K7TTQVPA855X3XVZCA7JZE","modified_at":"2026-10-23T00:36:58Z","published_at":"2026-10-22T20:57:36Z","references":["https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-45.json","https://www.cve.org/CVERecord?id=CVE-2026-114583"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"python-runtime","source_id":"PSF-2026-45","url":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-45.json"}],"summary":"tar filter allows writing outside destination via empty-named symlink"}