CVE-2026-28684
Medium
Description
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
SeverityMedium
CVSS6.6
Exploit probability—
ProductSaurabh-kumar Python-dotenv
PublishedApr 20, 2026
First seenApr 20, 2026
Weakness typeCWE-59Improper link resolutionCWE-61CWE-61
How to fix
Update
- saurabh-kumar python-dotenv1.2.2 or later
- python-dotenv1.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| saurabh-kumar python-dotenv | v < 1.2.2 | 1.2.2 |
| python-dotenvPyPI | v < 1.2.2 | 1.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.