Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. future
  4. ›
  5. CVE-2025-50817

CVE-2025-50817: Python-Future Module Arbitrary Code Execution via Unintended Import of test.py

August 14, 2025

A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code.

References

  • github.com/PythonCharmers/python-future
  • github.com/PythonCharmers/python-future/blob/v1.0.0/src/future/standard_library/__init__.py
  • github.com/advisories/GHSA-xqrq-4mgf-ff32
  • medium.com/@abcd_68700/cve-2025-50817-python-future-module-arbitrary-code-execution-via-unintended-import-of-test-py-f0818ea93cf4
  • nvd.nist.gov/vuln/detail/CVE-2025-50817
  • pypi.org/project/future

Code Behaviors & Features

Detect and mitigate CVE-2025-50817 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

Version 1.0.0

Solution

Unfortunately, there is no solution available yet.

Weakness

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Source file

pypi/future/CVE-2025-50817.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 19 Aug 2025 12:19:07 +0000.