GHSA-xmj3-9gf7-h52w: setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

October 23, 2026

On Windows, attacker-controlled content in a wheel’s .dist-info/namespace_packages.txt can cause setuptools’ legacy wheel installation path to create an __init__.py outside the requested destination_eggdir.

The attacker can influence the destination path, but not the contents of the created file.

References

github.com/advisories/GHSA-xmj3-9gf7-h52w
github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af
github.com/pypa/setuptools/pull/5329
github.com/pypa/setuptools/releases/tag/v84.1.0
github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w

Code Behaviors & Features

Detect and mitigate GHSA-xmj3-9gf7-h52w with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →