setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

影響: pip:setuptools >= 38.2.2, < 84.1.0 → 84.1.0

On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path, but not the contents of the created file. Details Tested setuptools commit: 6ead555c5fb29bc57fe6105b1bffc163f56fd558 Relevant source: setuptools/wheel.py SHA-256: 359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd The relevant ca…

在 GitHub Advisory Database 阅读

2026/10/24 06:44，GitHub Advisory Database 发布了“setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：Python。