Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28684 python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv… https://www.cve.org/CVERecord?id=CVE-2026-28684
Post summary
The text discloses that python-dotenv, before version 1.2.2, can read .env files and set environment variables via set_key() and unset_key(), and upgrading to 1.2.2 resolves the issue.
CVE-2026-28684 Arbitrary File Overwrite in python-dotenv via Symbolic Link Following https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28684
Post summary
The text announces CVE-2026-28684 as an arbitrary file overwrite vulnerability in python-dotenv via symbolic link following, without detailing PoC, exploit tools, active use, or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | saurabh-kumar | python-dotenv | - | python | - |