Live › vulnerability › GHSA-xmj3-9gf7-h52w
Go to dashboardOn Windows, a crafted wheel's namespace_packages.txt can make setuptools' legacy wheel-to-egg install write a fixed-content __init__.py to an attacker-chosen absolute path outside the install directory. The attacker controls only the location of the file, not its contents, and the write uses the installing process's permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:45 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| setuptools | pypi | >= 38.2.2, < 84.1.0 | 84.1.0 |
pip show setuptools or python -m setuptools --version and compare against 84.1.0
84.1.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
On Windows, attacker-controlled content in a wheel's
.dist-info/namespace_packages.txt can cause setuptools' legacy wheel
installation path to create an __init__.py outside the requested
destination_eggdir.
The attacker can influence the destination path, but not the contents of the created file.
Tested setuptools commit:
6ead555c5fb29bc57fe6105b1bffc163f56fd558
Relevant source:
setuptools/wheel.py
SHA-256:
359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd
The relevant call path is:
Wheel(wheel_path).install_as_egg(destination)
→ _install_as_egg
→ _convert_metadata
→ _fix_namespace_packages
A wheel can provide attacker-controlled content in:
<distribution>.dist-info/namespace_packages.txt
The namespace value is eventually used approximately as:
mod_dir = os.path.join(destination_eggdir, *mod.split('.'))
mod_init = os.path.join(mod_dir, '__init__.py')
If mod is a Windows drive-qualified absolute path containing no dots,
mod.split('.') preserves it as a single component.
On Windows, os.path.join(destination_eggdir, absolute_component) discards
the original base directory and resolves to the attacker-supplied absolute
path.
The existing wheel filename and ZIP traversal checks do not validate this
metadata value before it is subsequently interpreted as a filesystem path.
```markdown
### PoC
The reproduction was performed entirely inside a disposable temporary
directory.
Layout:
```text
sandbox/
destination/
outside/
input/
canary.txt
A synthetic wheel was created containing:
demo_pkg-1.0.dist-info/namespace_packages.txt
whose content was the absolute path of:
sandbox\outside
The real acquired setuptools implementation was then invoked:
setuptools.wheel.Wheel(synthetic_wheel).install_as_egg(
sandbox_destination
)
The operation completed without exception.
Expected metadata was created under:
sandbox\destination\EGG-INFO
but setuptools also created:
sandbox\outside\__init__.py
The file did not exist before execution.
Its contents were:
__import__('pkg_resources').declare_namespace(__name__)
The unrelated canary remained byte-identical.
The sandbox was deleted after recording the evidence.
### Impact
A crafted wheel can cause setuptools to create a fixed-content
`__init__.py` outside the intended installation directory at a
filesystem path influenced by the wheel, with the permissions of the
process performing the installation.
The demonstrated reproduction required the target parent directory to
already exist.
This page as .md · .json · in your agent: get_signal("GHSA-xmj3-9gf7-h52w")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.