# CVE-2026-23949: jaraco.context: jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip...

CVE-2026-23949 is fixed in 4 products on 1 platform, first by python3-jaraco.context 6.0.1-1ubuntu0.1, released January 19, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-23949
- Priority: High
- CVSS: 8.6 (high)
- EPSS: 0.0063
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 19, 2026

## Description

jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | jaraco.context Debian 13.5 (trixie) | 6.0.1-1+deb13u1 | [DEBIAN-CVE-2026-23949](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23949.md) | Jan 20, 2026 |
| Linux | jaraco.context Debian 14 | 6.0.1-2 | [DEBIAN-CVE-2026-23949](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23949.md) | Jan 20, 2026 |
| Linux | python-jaraco.context opensuse-leap 16.0 | 5.3.0-160000.3.1 | [OPENSUSE-SU-2026:20095-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20095-1.md) | Jan 23, 2026 |
| Linux | python-jaraco.context sles 16.0 | 5.3.0-160000.3.1 | [SUSE-SU-2026:20139-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20139-1.md) | Jan 23, 2026 |
| Linux | python3-jaraco.context Ubuntu 25.10 (questing) | 6.0.1-1ubuntu0.1 | [python3-jaraco.context 6.0.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-python3-jaraco.context-6.0.1-1ubuntu0.1.md) | Jan 19, 2026 |
| Linux | setuptools Debian 14 | 84.0.0-2 | [DEBIAN-CVE-2026-23949](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23949.md) | Jan 20, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.