CVE-2026-24049

Name of the Vulnerable Software and Affected Versions wheel versions 0.40.0 through 0.46.1

Description The 'wheel' package, a tool for manipulating Python wheel files, contains a flaw in the unpack function. This flaw allows for file permission modification through mishandling of file permissions after extraction. The logic incorrectly trusts the filename from the archive header when setting file permissions, even after the extraction process has sanitized the path. An attacker can craft a malicious wheel file that, when unpacked, alters the permissions of critical system files, potentially enabling Privilege Escalation or arbitrary code execution. The vulnerability is triggered when the unpack function applies permissions based on the unsanitized filename from the archive header. This can lead to critical system files becoming world-writable.

Recommendations Update to a version of wheel greater than 0.46.1.