CVE-2026-9323 Exposes Urwid Sessions

A severe vulnerability within the Urwid web display backend, identified as CVE-2026-9323, exposes terminal sessions to unauthorized access. By leveraging weaknesses in how session identifiers are generated and stored, attackers can gain complete control over active sessions, leading to potential code execution under the privileges of the session owner.

Predictable PRNG Session Identifiers

The core of the issue lies in the urwid/display/web.py file, where the Screen.start() method generates session identifiers, referred to as urwid_id. These identifiers are created by concatenating two outputs from random.randrange(10**9), which relies on the Mersenne Twister pseudorandom number generator.

Because the Mersenne Twister is not cryptographically secure, the identifier generation process is susceptible to prediction. Each call consumes roughly 30 bits of PRNG state, and since the internal state of the generator is 19,937 bits, an attacker can reconstruct that state by observing a sufficient number of session IDs exposed through the X-Urwid-ID HTTP response header.

Local Directory Information Exposure

Beyond the cryptographic weakness, the library suffers from an insecure implementation regarding local file storage. The same identifier used for web sessions is utilized as a filename for a FIFO created in the /tmp directory. Because this directory is world-listable, any local user on the host system can enumerate active session tokens simply by listing the directory contents.

• CVE-2026-9323 carries a CVSS severity score of 8.1.
• Reconstructing the internal PRNG state requires observing approximately 334 session IDs.
• The Mersenne Twister PRNG maintains an internal state of approximately 19,937 bits.

Impact on Terminal Integrity

With a captured session ID, an attacker can compromise the terminal environment in several ways. The polling endpoint allows unauthorized reading of the victim's terminal screen, while the ability to inject keystrokes into the session can lead to OS-level code execution if the session is running a shell. Furthermore, an attacker can flood the FIFO or inject exit sequences to force the session to crash or terminate prematurely. Documentation indicates that a prior Bandit S311 warning regarding this specific implementation was suppressed with a # noqa: S311 comment rather than being addressed.

Implications for System Exposure

The presence of this vulnerability suggests significant risks for any infrastructure relying on the Urwid web display backend. The dual nature of the threat—combining predictable identifiers with world-readable file paths—means that both remote observers and local users on the same host may be capable of hijacking sessions. For those managing environments where this library is in use, the combination of these vectors suggests a wide attack surface for potential session takeover and subsequent privilege escalation.