CVE-2026-103001: Python In Place Mutation Of Caller Supplied Options Mappingcve-2026-103001-python-in-place-mutation-of-caller-supplied-options-mapping
Caller-supplied mapping $OPT is mutated in place ($OPT[$K] = $OPT.get($K, $DEFAULT)) under a condition read from the same mapping. Dict arguments are aliased, so the caller's mapping is silently modified with these injected defaults. If the caller reuses the same mapping for a later call with stricter settings (e.g. verification re-enabled), the stale defaul
