From 97f8c1ffd58e50bdce62c13339c929842bb92e85 Mon Sep 17 00:00:00 2001
From: sethmlarson <18519037+sethmlarson@users.noreply.github.com>
Date: Tue, 29 Sep 2026 18:05:17 +0000
Subject: [PATCH] Update OSV records from CVE

---
 .../python/PSF-0000-CVE-2026-12345.json       | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 advisories/python/PSF-0000-CVE-2026-12345.json

diff --git a/advisories/python/PSF-0000-CVE-2026-12345.json b/advisories/python/PSF-0000-CVE-2026-12345.json
new file mode 100644
index 0000000..fd2940f
--- /dev/null
+++ b/advisories/python/PSF-0000-CVE-2026-12345.json
@@ -0,0 +1,45 @@
+{
+  "schema_version": "1.5.0",
+  "id": "PSF-0000-CVE-2026-12345",
+  "aliases": [
+    "CVE-2026-12345"
+  ],
+  "published": "2026-09-29T17:46:01.811Z",
+  "modified": "2026-09-29T17:55:00.520Z",
+  "details": "The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.",
+  "affected": [
+    {
+      "ranges": [
+        {
+          "type": "GIT",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5c20517a4fc56683efe63a7751020db9573f538d"
+            }
+          ],
+          "repo": "https://github.com/python/cpython"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/pull/157580"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/python/cpython/issues/157579"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": []
+  }
+}
\ No newline at end of file