A vulnerability in the Python programming language that was discovered fifteen (15) years ago has made a resurgence in a report published by Trellix researchers. Originally disclosed in 2007, the vulnerability, tracked as CVE-2007-4559, exists in the tarfile package in Python’s standard library. This package allows Python developers to read and write tar files, a compressed file similar to zip files that is most known for its use with the Linux operating system. The bug is classified as a path traversal bug in the function “tarfile.extract()” and, if the input to this function is not sanitized, the vulnerability allows attackers to escape the current directory and extract the compressed files to a location of the attacker’s choosing. This can be utilized in an exploit chain that leads to remote code execution (RCE), as seen in the Spyder IDE exploit example given by the researcher. To identify the scope of the vulnerability, the researcher built a script to search through open-source applications on GitHub and identify potentially vulnerable applications. Manually checking repositories led to the discovery that 61% of the 257 identified projects contained vulnerable code that could be exploited. In total, over 588,000 repositories include the tarfile package leading to an estimate that 350,000 projects are potentially vulnerable and exploitable. In addition, machine learning tools that assist developers in coding projects suggest that the code is vulnerable to this exploit when instructed to extract tar files, potentially leading to new projects being vulnerable as well. The researcher warns of a massive supply chain issue presented by this vulnerability and has begun submitting patches to open-source repositories as well as open-sourcing the tool used to scan repositories for this issue. It is not clear if this vulnerability is currently being exploited in the wild. CTIX analysts recommend developers using the tarfile package ensure their projects are not vulnerable and to implement sanitization in projects that are.