HIGH: wheel@0.42.0 — Path Traversal leading to Arbitrary File Permission Modification (GHSA-8rrh-rw8j-w5fx / CVE-2026-24049)

[realfishsam]

Vulnerability

Severity: HIGH
Package: wheel@0.42.0
Advisory: GHSA-8rrh-rw8j-w5fx / CVE-2026-24049
Affected component: py-sdk
Dependency type: direct build dependency (sdks/python/pyproject.toml → [build-system] requires = ["setuptools>=61.0", "wheel"])

Description

wheel ≤0.46.1 contains a path traversal vulnerability in the unpack function. A maliciously crafted wheel file can include entries with ../ path components. During unpacking, wheel applies file permissions (chmod) using the path from the zip entry rather than the sanitized extraction path. This allows an attacker-controlled wheel to change the filesystem permissions of arbitrary files outside the extraction directory — including system files, SSH keys, or application configurations — to world-writable (777), enabling privilege escalation or arbitrary code execution.

Fix

Recommended version: wheel ≥0.46.2
Fix command:

pip install "wheel>=0.46.2"

Or update the [build-system] constraint in sdks/python/pyproject.toml:

requires = ["setuptools>=78.1.1", "wheel>=0.46.2"]

Risk Assessment

wheel is a direct build dependency — it is invoked when building the Python SDK. The path traversal + chmod exploit requires a developer or CI pipeline to unpack a maliciously crafted wheel file. In a CI/CD context (e.g., GitHub Actions building or testing the py-sdk), a typosquatted or compromised package installed during the build could trigger this vulnerability to modify file permissions on the build runner, potentially enabling persistence or lateral movement. Combined with the setuptools RCE advisory tracked in #824, the py-sdk build environment has multiple critical supply-chain risks requiring prompt remediation.

---

Found by automated dependency vulnerability scan