An update for python-urwid is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3193 Final 1.0 1.0 2026-08-01 Initial 2026-08-01 2026-08-01 openEuler SA Tool V1.0 2026-08-01 python-urwid security update An update for python-urwid is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 Urwid is a console user interface library for Python. It includes many features useful for text console application developers Security Fix(es): The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim's terminal screen via the polling endpoint, inject keystrokes into the victim's session (yielding OS-level code execution with the session owner's privileges if the session runs a shell), and inject exit sequences or flood the FIFO to terminate or crash the session. A prior Bandit S311 warning on this usage was suppressed with # noqa: S311 rather than fixed(CVE-2026-9323) An update for python-urwid is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-urwid https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3193 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-9323 https://nvd.nist.gov/vuln/detail/CVE-2026-9323 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 python-urwid-2.1.2-4.oe2203sp4.src.rpm python-urwid-2.1.2-6.oe2403sp1.src.rpm python-urwid-2.1.2-6.oe2403sp3.src.rpm python-urwid-2.1.2-6.oe2403sp4.src.rpm python-urwid-2.1.2-3.oe2003sp4.src.rpm python-urwid-debuginfo-2.1.2-4.oe2203sp4.aarch64.rpm python-urwid-debugsource-2.1.2-4.oe2203sp4.aarch64.rpm python3-urwid-2.1.2-4.oe2203sp4.aarch64.rpm python-urwid-debuginfo-2.1.2-6.oe2403sp1.aarch64.rpm python-urwid-debugsource-2.1.2-6.oe2403sp1.aarch64.rpm python3-urwid-2.1.2-6.oe2403sp1.aarch64.rpm python-urwid-debuginfo-2.1.2-6.oe2403sp3.aarch64.rpm python-urwid-debugsource-2.1.2-6.oe2403sp3.aarch64.rpm python3-urwid-2.1.2-6.oe2403sp3.aarch64.rpm python-urwid-debuginfo-2.1.2-6.oe2403sp4.aarch64.rpm python-urwid-debugsource-2.1.2-6.oe2403sp4.aarch64.rpm python3-urwid-2.1.2-6.oe2403sp4.aarch64.rpm python-urwid-debuginfo-2.1.2-3.oe2003sp4.aarch64.rpm python-urwid-debugsource-2.1.2-3.oe2003sp4.aarch64.rpm python3-urwid-2.1.2-3.oe2003sp4.aarch64.rpm python-urwid-debuginfo-2.1.2-4.oe2203sp4.x86_64.rpm python-urwid-debugsource-2.1.2-4.oe2203sp4.x86_64.rpm python3-urwid-2.1.2-4.oe2203sp4.x86_64.rpm python-urwid-debuginfo-2.1.2-6.oe2403sp1.x86_64.rpm python-urwid-debugsource-2.1.2-6.oe2403sp1.x86_64.rpm python3-urwid-2.1.2-6.oe2403sp1.x86_64.rpm python-urwid-debuginfo-2.1.2-6.oe2403sp3.x86_64.rpm python-urwid-debugsource-2.1.2-6.oe2403sp3.x86_64.rpm python3-urwid-2.1.2-6.oe2403sp3.x86_64.rpm python-urwid-debuginfo-2.1.2-6.oe2403sp4.x86_64.rpm python-urwid-debugsource-2.1.2-6.oe2403sp4.x86_64.rpm python3-urwid-2.1.2-6.oe2403sp4.x86_64.rpm python-urwid-debuginfo-2.1.2-3.oe2003sp4.x86_64.rpm python-urwid-debugsource-2.1.2-3.oe2003sp4.x86_64.rpm python3-urwid-2.1.2-3.oe2003sp4.x86_64.rpm The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim's terminal screen via the polling endpoint, inject keystrokes into the victim's session (yielding OS-level code execution with the session owner's privileges if the session runs a shell), and inject exit sequences or flood the FIFO to terminate or crash the session. A prior Bandit S311 warning on this usage was suppressed with # noqa: S311 rather than fixed 2026-08-01 CVE-2026-9323 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 High 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H python-urwid security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3193