CVE-2026-9323
The urwid web display backend creates session identifiers using Python's non‑cryptographic Mersenne Twister PRNG. By observing roughly 334 session IDs (e.g., from the X‑Urwid‑ID header), an attacker can reconstruct the PRNG state and predict all past and future IDs. The same identifier is used as a world‑readable FIFO filename in /tmp, allowing any local user to list active tokens; with a valid token an attacker can view the victim’s terminal, inject keystrokes (potentially leading to code execution), or disrupt the session.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
No specific products listed via CPE.
Real-world impact
An attacker who can predict or read the session ID can hijack the user's terminal session, potentially execute commands with the user's privileges, or cause a denial‑of‑service.
Why this severity
CVSS base score 9.2 (Critical) reflects network‑attackable, low‑privilege impact with high confidentiality and integrity consequences.
What to do about it
- 01No official fix is mentioned in the provided sources; users should monitor the urwid project for a patch that replaces the PRNG with a cryptographically secure random number generator and ensures session identifiers are not placed in world‑accessible locations.
- ›Limit exposure of the X‑Urwid‑ID header, restrict /tmp permissions to prevent other users from listing FIFO files, and avoid running privileged shells within urwid web sessions until a fix is available.
Remediation guidance is derived solely from the description; no vendor advisory or CISA KEV action is specified.
Timeline
- Jul 18, 2026 · 15d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.