Directory Traversal The advisory has been revoked - it doesn't affect any version of package py3.10-virtualenv-bin (opens in a new tab)

Threat Intelligence

0.31% (23^rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-MINIMOSLATEST-PY310VIRTUALENVBIN-15251328
published10 Feb 2026
disclosed22 Jan 2026

Report a new vulnerability Found a mistake?

Introduced: 22 Jan 2026

CVE-2026-24049 (opens in a new tab) CWE-22 (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream py3.10-virtualenv-bin package and not the py3.10-virtualenv-bin package as distributed by Minimos.

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.