From 7a7d2de96b22a9adf9208afcc9547e1001569fef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20Gr=C3=B6nholm?= Date: Thu, 22 Jan 2026 01:41:14 +0200 Subject: [PATCH] Fixed security issue around wheel unpack (#675) A maliciously crafted wheel could cause the permissions of a file outside the unpack tree to be altered. CVE: CVE-2026-24049 Upstream: https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef.patch [thomas: change filename, remove tests] Signed-off-by: Thomas Perale --- src/wheel/cli/unpack.py | 4 ++-- 3 files changed, 27 insertions(+), 2 deletions(-) diff --git a/src/wheel/cli/unpack.py b/src/wheel/cli/unpack.py index d48840e6e..83dc7423f 100644 --- a/src/wheel/cli/unpack.py +++ b/src/wheel/cli/unpack.py @@ -19,12 +19,12 @@ def unpack(path: str, dest: str = ".") -> None: destination = Path(dest) / namever print(f"Unpacking to: {destination}...", end="", flush=True) for zinfo in wf.filelist: - wf.extract(zinfo, destination) + target_path = Path(wf.extract(zinfo, destination)) # Set permissions to the same values as they were set in the archive # We have to do this manually due to # https://github.com/python/cpython/issues/59999 permissions = zinfo.external_attr >> 16 & 0o777 - destination.joinpath(zinfo.filename).chmod(permissions) + target_path.chmod(permissions) print("OK")