{"id":"ghsa-ghsa-xmj3-9gf7-h52w","seq":661312,"kind":"advisory","title":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","url":"https://github.com/advisories/GHSA-xmj3-9gf7-h52w","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xmj3-9gf7-h52w","summary":"影響: pip:setuptools >= 38.2.2, < 84.1.0 → 84.1.0\nOn Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path, but not the contents of the created file. Details Tested setuptools commit: 6ead555c5fb29bc57fe6105b1bffc163f56fd558 Relevant source: setuptools/wheel.py SHA-256: 359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd The relevant ca…","severity":"low","techs":["python"],"cves":[],"tags":["GHSA-xmj3-9gf7-h52w","setuptools"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:44:11.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}