Backport upstream commit 8eb178480bd1a2b223f509fc430796b265158dfb
to fix CVE-2026-8643. The patch adds validation to reject wheel
entry point names containing path traversal components (e.g. ".."
or absolute paths) that could cause scripts to be installed
outside the intended scripts directory. A new _script_within_dir
helper function and updated _raise_for_invalid_entrypoint logic
in pip's wheel installer enforce this check. Comprehensive tests
are included.
CVE: CVE-2026-8643
Upstream patches:
- 8eb178480b.patch
Resolves: RHEL-191157
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Fedora contributions by:
Bill Nottingham <notting@fedoraproject.org>
Charalampos Stratakis <cstratak@redhat.com>
David Malcolm <dmalcolm@redhat.com>
Dennis Gilmore <dennis@ausil.us>
Jon Ciesla <limburgher@gmail.com>
Karolina Surma <ksurma@redhat.com>
Kevin Fenzi <kevin@fedoraproject.org>
Kevin Kofler <Kevin@tigcc.ticalc.org>
Lukáš Zachar <lzachar@redhat.com>
Luke Macken <lmacken@redhat.com>
Lumír Balhar <lbalhar@redhat.com>
Marcel Plch <mplch@redhat.com>
Matej Stuchlik <mstuchli@redhat.com>
Maxwell G <maxwell@gtmx.me>
Michal Cyprian <m.cyprian@gmail.com>
Miro Hrončok <mhroncok@redhat.com>
Orion Poplawski <orion@cora.nwra.com>
Pádraig Brady <P@draigBrady.com>
Peter Halliday <phalliday@excelsiorsystems.net>
Petr Viktorin <pviktori@redhat.com>
Robert Kuska <rkuska@redhat.com>
Slavek Kabrda <bkabrda@redhat.com>
Tim Flink <tflink@fedoraproject.org>
Tomáš Hrnčiar <thrnciar@redhat.com>
Tomas Orsava <torsava@redhat.com>
Toshio Kuratomi <toshio@fedoraproject.org>
Victor Stinner <vstinner@redhat.com>
Ville Skyttä <ville.skytta@iki.fi>
