## setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description

- 種別: advisory
- 重大度: low
- 関連技術: python
- 公開日時: 2026-10-23T21:44:11.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-xmj3-9gf7-h52w)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-xmj3-9gf7-h52w

影響: pip:setuptools >= 38.2.2, < 84.1.0 → 84.1.0
On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path, but not the contents of the created file. Details Tested setuptools commit: 6ead555c5fb29bc57fe6105b1bffc163f56fd558 Relevant source: setuptools/wheel.py SHA-256: 359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd The relevant ca…