René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Sec]: Disable auto-loading custom matplotlibrc files","articleBody":"**Issue Description:**\n\n`matplotlibrc` files are autoloaded on `import matplotlib`. When `matplotlib_fname` searches for this file, the first candidate it yields is the bare filename `'matplotlibrc'` in the current working directory. If an attacker can place a `matplotlibrc` file in a directory where a user runs Python (e.g., a cloned git repository, a shared project directory, a downloads folder), all rcParams in that file are applied automatically when `import matplotlib` or `import matplotlib.pyplot` executes.\n\nSeveral of the rcparams can set up common calls such as figure creation (https://github.com/matplotlib/matplotlib/pull/31293) or latex text rendering (https://github.com/matplotlib/matplotlib/pull/31249) such that they can execute arbitrary code from the `matplotlibrc` file as a side-effect. This presents a potential security risk.\n\nThe two linked threads above talk a bit about how an attacker which can place a file on the PATH, could alternatively just place an executable which wraps some module and silently imports with arbitrary import-time side effects, and so this is a security boundary that matplotlib should not try to include. My take is that this sort of script would appear as code and be likely flagged in a manual or automatic security audit, whereas a `matplotlibrc` file is not directly executable and appears as data. Someone who assumes the common principle of separating data and code would not think that this file might be risky.\n\nThis is not a critical vulnerability, but represents an opportunity for security hardening.\n\n**How to Solve:**\nStop auto-loading custom `matplotlibrc` files. Allow the user to opt-in to this via a function or setting the MATPLOTLIBRC environment variable.\n\nNote that this may require some discussion to figure out the best solution, and I do not recommend this as a first-time contributor issue.","author":{"url":"https://github.com/scottshambaugh","@type":"Person","name":"scottshambaugh"},"datePublished":"2026-03-21T17:26:35.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":14},"url":"https://github.com/31346/matplotlib/issues/31346"}