Summary
A path traversal vulnerability in uv allows a malicious Python wheel to write files outside the intended scripts directory through crafted console_scripts or gui_scripts entry point names.
If an attacker convinces a user or automated system to install the wheel, the package may place executables in directories on PATH, potentially shadowing or overwriting trusted binaries and enabling code execution.
A path traversal vulnerability in uv allows a malicious Python wheel to write files outside the intended scripts directory through crafted console_scripts or gui_scripts entry point names.
If an attacker convinces a user or automated system to install the wheel, the package may place executables in directories on PATH, potentially shadowing or overwriting trusted binaries and enabling code execution.
Affected context
The vulnerability occurs during installation of Python wheels when uv processes console_scripts or gui_scripts entry point names without sufficiently constraining their resulting filesystem paths. It becomes risky when a user, build system, or deployment workflow installs a wheel from an untrusted or insufficiently vetted source and the installer has write access to PATH directories or other sensitive locations.
The vulnerability occurs during installation of Python wheels when uv processes console_scripts or gui_scripts entry point names without sufficiently constraining their resulting filesystem paths. It becomes risky when a user, build system, or deployment workflow installs a wheel from an untrusted or insufficiently vetted source and the installer has write access to PATH directories or other sensitive locations.
Exploit preconditions
- Attack surface: Python wheel installation and script generation
- Required access: The ability to induce a user, build pipeline, or deployment process to install a malicious wheel
- Trigger point: Processing crafted
console_scriptsorgui_scriptsentry point names - Why exploitation is possible: Insufficient path confinement may allow generated files to escape the intended scripts directory and reach attacker-selected filesystem locations
- Attack surface: Python wheel installation and script generation
- Required access: The ability to induce a user, build pipeline, or deployment process to install a malicious wheel
- Trigger point: Processing crafted
console_scriptsorgui_scriptsentry point names - Why exploitation is possible: Insufficient path confinement may allow generated files to escape the intended scripts directory and reach attacker-selected filesystem locations
Why this happens
The underlying bug is improper validation and canonicalization of attacker-controlled file names during wheel installation. Entry point names are treated as filesystem paths without reliably enforcing that generated scripts remain within the designated scripts directory. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
The underlying bug is improper validation and canonicalization of attacker-controlled file names during wheel installation. Entry point names are treated as filesystem paths without reliably enforcing that generated scripts remain within the designated scripts directory. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
Potential impact
- Malicious files may be written outside the intended installation directory
- Executables in PATH directories may be shadowed or overwritten
- Subsequent commands may execute attacker-controlled programs
- Local development environments or build agents could be compromised
- Automated installation workflows may propagate tampered executables
- Malicious files may be written outside the intended installation directory
- Executables in PATH directories may be shadowed or overwritten
- Subsequent commands may execute attacker-controlled programs
- Local development environments or build agents could be compromised
- Automated installation workflows may propagate tampered executables
General mitigation guidance
Mitigation generally focuses on enforcing strict path confinement during script generation and reducing trust in package metadata.
Common defensive patterns include:
- Treating wheel metadata, including entry point names, as untrusted input
- Rejecting absolute paths, traversal components, separators, and other unsafe filename forms
- Canonicalizing candidate paths and verifying they remain beneath the intended scripts directory
- Writing files using controlled, secure path APIs rather than concatenating strings
- Avoiding installation into privileged or broadly shared PATH directories where possible
- Applying least-privilege permissions to package installation processes
- Requiring package provenance, review, and integrity checks before installation
Mitigation generally focuses on enforcing strict path confinement during script generation and reducing trust in package metadata.
Common defensive patterns include:
- Treating wheel metadata, including entry point names, as untrusted input
- Rejecting absolute paths, traversal components, separators, and other unsafe filename forms
- Canonicalizing candidate paths and verifying they remain beneath the intended scripts directory
- Writing files using controlled, secure path APIs rather than concatenating strings
- Avoiding installation into privileged or broadly shared PATH directories where possible
- Applying least-privilege permissions to package installation processes
- Requiring package provenance, review, and integrity checks before installation
How teams detect issues like this
Detection can combine static analysis, package inspection, and runtime policy controls.
- Review installer code for path construction based on wheel metadata without canonicalization or directory-boundary checks.
- Use static analysis rules to identify unsafe joins, unchecked entry point names, and file writes derived from package contents.
- Inspect wheels for entry point names containing absolute paths, traversal sequences, separators, or unexpected filename characters.
- Monitor package installation events and unexpected writes to PATH directories or other executable locations.
- Enforce CI and endpoint policies that restrict untrusted package installation and flag modifications to protected directories.
- Automated code and artifact review tools may help identify suspicious metadata and path-handling patterns.
Detection can combine static analysis, package inspection, and runtime policy controls.
- Review installer code for path construction based on wheel metadata without canonicalization or directory-boundary checks.
- Use static analysis rules to identify unsafe joins, unchecked entry point names, and file writes derived from package contents.
- Inspect wheels for entry point names containing absolute paths, traversal sequences, separators, or unexpected filename characters.
- Monitor package installation events and unexpected writes to PATH directories or other executable locations.
- Enforce CI and endpoint policies that restrict untrusted package installation and flag modifications to protected directories.
- Automated code and artifact review tools may help identify suspicious metadata and path-handling patterns.
