Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cheetah | Tavis_rudd | 0.9.15 (including) | 0.9.15 (including) |
| Cheetah | Tavis_rudd | 0.9.16 (including) | 0.9.16 (including) |