setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

影響: pip:setuptools >= 38.2.2, < 84.1.0 → 84.1.0

On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path, but not the contents of the created file. Details Tested setuptools commit: 6ead555c5fb29bc57fe6105b1bffc163f56fd558 Relevant source: setuptools/wheel.py SHA-256: 359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd The relevant ca…

Read on GitHub Advisory Database

On 10/24/2026, 06:44 AM, GitHub Advisory Database published "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description" (type: Advisory). Severity is "Low" (low). Related technologies: Python.