Unearth
Monthly
Path traversal in the unearth Python package discovery library through version 0.18.2 allows an attacker who controls or compromises a package source to write arbitrary files to any filesystem location accessible to the extracting process. The flaw resides in the is_within_directory function, which performs only a lexical path containment check without resolving symlinks or normalizing ../ sequences via os.path.realpath(), meaning maliciously crafted tar archive members silently bypass the extraction guard. A publicly available proof-of-concept exists at GitHub issue #180; the upstream fix was merged in commit 6c78164, but no confirmed active exploitation per CISA KEV has been reported.
pdm is a Python package and dependency manager supporting the latest PEP standards. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Path traversal in the unearth Python package discovery library through version 0.18.2 allows an attacker who controls or compromises a package source to write arbitrary files to any filesystem location accessible to the extracting process. The flaw resides in the is_within_directory function, which performs only a lexical path containment check without resolving symlinks or normalizing ../ sequences via os.path.realpath(), meaning maliciously crafted tar archive members silently bypass the extraction guard. A publicly available proof-of-concept exists at GitHub issue #180; the upstream fix was merged in commit 6c78164, but no confirmed active exploitation per CISA KEV has been reported.
pdm is a Python package and dependency manager supporting the latest PEP standards. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.