CVE-2026-87910 Python Software Foundation CVE debrief

Who should care

System administrators and developers using Python's tarfile module, especially those handling archives from untrusted sources, should assess their exposure and implement necessary security measures.

Why it matters

CVE-2026-87910 is a medium-severity vulnerability in Python's tarfile module that may lead to security concerns when extracting links on unsupported systems. System administrators and developers should assess their exposure and implement necessary security measures.

• Potential security issues when extracting links on systems that do not support links.
• Unexpected behavior when processing archives using Python's tarfile module.
• Need for additional security measures when handling archives from untrusted sources.

Technical summary

The Python tarfile module incorrectly handles link extraction on systems that do not support links. This may lead to unexpected behavior when processing archives. The issue arises when extracting links on systems that do not support links, potentially leading to security concerns. The tarfile module falls back to extracting a member from the archive when it encounters a link on a system that doesn't support links. During this process, the filter function is executed twice: once for the extracted member and once with the name set to the location of the link. However, the return value from one of these calls was ignored. To address this, the member should be skipped if either call returns None, ensuring proper  

Defensive priority

Medium priority for systems using Python's tarfile module, especially those handling archives from untrusted sources.

Recommended defensive actions

• Review and update Python's tarfile module to ensure proper handling of link extraction on systems that do not support links.
• Implement additional security measures for systems handling archives from untrusted sources.
• Monitor for any potential security incidents related to this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD details indicate a medium-severity vulnerability in Python's tarfile module. The issue arises when extracting links on systems that do not support links, potentially leading to security concerns.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.