python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
References
| Link | Resource |
|---|---|
| https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311 | Patch |
| https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2 | Release Notes |
| https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 | Exploit Patch Vendor Advisory |
| https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 | Exploit Patch Vendor Advisory |
Configurations
History
27 Apr 2026, 13:44
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:saurabh-kumar:python-dotenv:*:*:*:*:*:python:*:* | |
| References | () https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311 - Patch | |
| References | () https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2 - Release Notes | |
| References | () https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 - Exploit, Patch, Vendor Advisory | |
| First Time |
Saurabh-kumar python-dotenv
Saurabh-kumar |
20 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 - |
20 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-20 17:16
Updated : 2026-04-27 13:44
NVD link : CVE-2026-28684
Mitre link : CVE-2026-28684
CVE.ORG link : CVE-2026-28684
JSON object : View
Products Affected
saurabh-kumar
- python-dotenv