Running `python` interpreter will import `readline.py` file in current directory.
It causes unexpected code execution.

This problem is reported by 'Japan Vulnerability Notes' as a bug on
Windows version Python http://jvn.jp/jp/JVN49503705/

It says that when we run Windows version python will import `readline.pyd` file in current directory. And it may run unexpected codes with permission assigned to python.exe.

The line causing this problem may be...
https://github.com/python/cpython/blob/2.7/Lib/code.py#L303


Should it be considered as vulnerability of python (or Windows version python)?

I can reproduce this action on Ubuntu.

The forged readline.py in python's execution directory can steal the
permission of python and do something dangerous.

This is not a bug, this is the way python works.  When running in interactive mode (only) the current directory is first on the path.

Now, should this behavior be changed?  I think we've discussed this before and decided not to change it (for backward compatibility reasons), but I think there was dissent and that increasing emphasis on security since that discussion might argue for a different outcome.  It's a python-dev mailing list level issue, in any case.

Well, so much for my memory :(.

The actual discussion was in issue 12238, where *my* conclusion was that this should be fixed (readline should be special cased), but the issue is still open.

Patches welcome :)

I see. Thank you very much, guys.

python3 -I

could be used as a workaround.