# Build corruption when using `PYO3_CONFIG_FILE` environment variable

Source: https://junglewise.ai/threats/build-corruption-when-using-pyo3-config-file-environment-variable-cb118867  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-05  
License: CC BY 4.0 with a link back

Severity: info · Published 2024-12-05

Build corruption when using `PYO3_CONFIG_FILE` environment variable

Technologies: [pyo3 (crates.io)](https://junglewise.ai/threats/technologies/pyo3). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 5 December 2024.

**Which products and versions are affected?** pyo3 (crates.io) SEMVER:introduced=0.23.0,fixed=0.23.3.

**Is there a fix for This vulnerability?** Yes. pyo3 (crates.io): upgrade to 0.23.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run pyo3 (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyo3 (crates.io): upgrade to 0.23.3 or later

  ```sh
  cargo update -p pyo3
  ```


## Affected products

- pyo3 (crates.io) SEMVER:introduced=0.23.0,fixed=0.23.3

## Related threats

- [PyO3 missing Sync bound in PyCFunction new_closure](https://junglewise.ai/threats/pyo3-missing-sync-bound-in-pycfunction-new-closure-37dd6bc7)
- [PyO3 out-of-bounds read in list and tuple iterators](https://junglewise.ai/threats/pyo3-out-of-bounds-read-in-list-and-tuple-iterators-31441968)
- [RUSTSEC-2026-0177 - Missing `Sync` bound on `PyCFunction::new_closure` closures](https://junglewise.ai/threats/rustsec-2026-0177-missing-sync-bound-on-pycfunction-new-closure-e8081edc)
- [RUSTSEC-2026-0176 - Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators](https://junglewise.ai/threats/rustsec-2026-0176-out-of-bounds-read-in-nth-nth-back-for-pylist-and-f3042ce7)
- [PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature](https://junglewise.ai/threats/pyo3-has-type-confusion-when-accessing-data-from-sublasses-of-2db99dde)