Arbitrary Code Injection Affecting pywikibot package, versions [,10.7.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Code Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-PYWIKIBOT-14171931
- published4 Dec 2025
- disclosed2 Dec 2025
- creditUnknown
Introduced: 2 Dec 2025
CVE NOT AVAILABLE CWE-94 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade pywikibot to version 10.7.1 or higher.
Overview
pywikibot is a Python MediaWiki Bot Framework
Affected versions of this package are vulnerable to Arbitrary Code Injection via the readPassword method in pywikibot.login, which used eval() on password file entries. Each non-empty, non-comment line from the configured password file was evaluated with Python’s eval without restricting the syntax, allowing arbitrary Python expressions in that file to execute within the pywikibot process.