CVE-2009-0367
NoneCVSS
—
EPSS
10.9%
Published
Mar 5, 2009
CISA due date
—
The record
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | wesnoth | 0 | 1.2-5 |
| Debian:5.0 | wesnoth | 0 | 1:1.4.4-2+lenny1 |
Related vulnerabilities
- CVE-2026-81644 DoS vulnerability in the preview service module. CWE-264
- CVE-2026-49315 DoS vulnerability in the input device module. CWE-264
- CVE-2026-49313 Permission control vulnerability in the app lock module. CWE-264
- CVE-2026-49312 Permission control vulnerability in the window module. CWE-264
- CVE-2026-49310 Permission control vulnerability in the event notification module. CWE-264
- CVE-2026-41987 Permission control vulnerability in the app management module. CWE-264
- CVE-2026-49309 Permission control vulnerability in the Settings module. CWE-264
- CVE-2026-49308 Permission control vulnerability in the clipboard module. Impact: Successful exploitation… CWE-264