This is a security fix. Disclosure following shortly. Thanks to Jedediah Smith for the report.
StringIO import was adapted for compatibility with Python 2.