setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

影響: pip:setuptools >= 38.2.2, < 84.1.0 → 84.1.0

On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path, but not the contents of the created file. Details Tested setuptools commit: 6ead555c5fb29bc57fe6105b1bffc163f56fd558 Relevant source: setuptools/wheel.py SHA-256: 359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd The relevant ca…

GitHub Advisory Databaseで読む

2026/10/24 06:44、GitHub Advisory Databaseが「setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: Python。