CVE-2026-3479 pkgutil.get_data() does not enforce documented restrictions