CPython SourcelessFileLoader Legacy PYC File Handling Improperly Bypasses Validation

A vulnerability exists in CPython's import hook for legacy sourceless '.pyc' files. The issue arises because the 'SourcelessFileLoader' subclass does not correctly use 'io.open_code()' to read these files, which can lead to validation bypass. This vulnerability affects CPython versions 3.10, 3.11, 3.12, 3.13, and 3.14.

Impact

This vulnerability can be exploited by manipulating the module search path to prioritize a module's '.pyc' file, bypassing any validation that would normally be applied when using 'io.open_code()'.

Reproduction

The vulnerability can be reproduced by hooking 'io.open_code()' to perform validation and then placing a module's '.pyc' file earlier in the search path. When the module is imported, the validation will be bypassed, as the 'SourcelessFileLoader' will not be correctly handled.

Remediation

The vulnerability has been fixed in CPython. Users should update to the latest version.