In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
BPO | [24778](https://bugs.python.org/issue24778)
--- | :---
Nosy | @vstinner, @bitdancer
Files | <li>[screenshot.png](https://bugs.python.org/file40099/screenshot.png "Uploaded as image/png at 2015-08-02.08:25:06 by TheRegRunner")</li><li>[The Quote Problem.py](https://bugs.python.org/file40116/The%20Quote%20Problem.py "Uploaded as text/plain at 2015-08-03.19:27:35 by TheRegRunner")</li><li>[mailcap patch.zip](https://bugs.python.org/file40897/mailcap%20patch.zip "Uploaded as application/zip at 2015-10-29.19:26:36 by TheRegRunner"): mailcap.py patches and diffs for python2.7 and python 3.5</li>

<sup>*Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.*</sup>

<details><summary>Show more details</summary><p>

GitHub fields:
```python
assignee = None
closed_at = None
created_at = <Date 2015-08-02.08:25:07.171>
labels = ['type-security', '3.11', 'library', 'docs']
title = 'mailcap.findmatch: document shell command Injection danger in filename parameter'
updated_at = <Date 2022-04-06.15:30:37.106>
user = 'https://bugs.python.org/TheRegRunner'
```

bugs.python.org fields:
```python
activity = <Date 2022-04-06.15:30:37.106>
actor = 'vstinner'
assignee = 'docs@python'
closed = False
closed_date = None
closer = None
components = ['Documentation', 'Library (Lib)']
creation = <Date 2015-08-02.08:25:07.171>
creator = 'TheRegRunner'
dependencies = []
files = ['40099', '40116', '40897']
hgrepos = []
issue_num = 24778
keywords = []
message_count = 14.0
messages = ['247857', '247861', '247944', '247946', '247951', '247979', '247992', '248058', '248061', '248062', '248070', '248074', '253689', '416878']
nosy_count = 4.0
nosy_names = ['vstinner', 'r.david.murray', 'docs@python', 'TheRegRunner']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue24778'
versions = ['Python 3.11']
```

</p></details>


<!-- gh-linked-prs -->
### Linked PRs
* gh-105298
* gh-105299
* gh-105300
<!-- /gh-linked-prs -->

[CVE-2015-20107] mailcap.findmatch: document shell command Injection danger in filename parameter
This is a GitHub Issue
repo:cpython
owner:python
Title : [CVE-2015-20107] mailcap.findmatch: document shell command Injection danger in filename parameter
Issue date:

--- start body ---
BPO | [24778](https://bugs.python.org/issue24778)
--- | :---
Nosy | @vstinner, @bitdancer
Files | <li>[screenshot.png](https://bugs.python.org/file40099/screenshot.png "Uploaded as image/png at 2015-08-02.08:25:06 by TheRegRunner")</li><li>[The Quote Problem.py](https://bugs.python.org/file40116/The%20Quote%20Problem.py "Uploaded as text/plain at 2015-08-03.19:27:35 by TheRegRunner")</li><li>[mailcap patch.zip](https://bugs.python.org/file40897/mailcap%20patch.zip "Uploaded as application/zip at 2015-10-29.19:26:36 by TheRegRunner"): mailcap.py patches and diffs for python2.7 and python 3.5</li>

<sup>*Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.*</sup>

<details><summary>Show more details</summary><p>

GitHub fields:
```python
assignee = None
closed_at = None
created_at = <Date 2015-08-02.08:25:07.171>
labels = ['type-security', '3.11', 'library', 'docs']
title = 'mailcap.findmatch: document shell command Injection danger in filename parameter'
updated_at = <Date 2022-04-06.15:30:37.106>
user = 'https://bugs.python.org/TheRegRunner'
```

bugs.python.org fields:
```python
activity = <Date 2022-04-06.15:30:37.106>
actor = 'vstinner'
assignee = 'docs@python'
closed = False
closed_date = None
closer = None
components = ['Documentation', 'Library (Lib)']
creation = <Date 2015-08-02.08:25:07.171>
creator = 'TheRegRunner'
dependencies = []
files = ['40099', '40116', '40897']
hgrepos = []
issue_num = 24778
keywords = []
message_count = 14.0
messages = ['247857', '247861', '247944', '247946', '247951', '247979', '247992', '248058', '248061', '248062', '248070', '248074', '253689', '416878']
nosy_count = 4.0
nosy_names = ['vstinner', 'r.david.murray', 'docs@python', 'TheRegRunner']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue24778'
versions = ['Python 3.11']
```

</p></details>


<!-- gh-linked-prs -->
### Linked PRs
* gh-105298
* gh-105299
* gh-105300
<!-- /gh-linked-prs -->

--- end body ---

The issue describes a potential security vulnerability in the `mailcap.findmatch` function of Python, where the `filename` parameter can be exploited for shell command injection. This could allow an attacker to execute arbitrary commands on the host system if the input is not properly sanitized.