wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.46.1 and below, the unpack function is vulnerable to file…

CVE-2026-24049 affects the Python wheel command line tool versions 0.46.1 and below. The vulnerability exists in the unpack function which mishandles file permissions after extraction. The flaw allows attackers to craft malicious wheel files that can change permissions of critical system files like /etc/passwd, SSH keys, and config files when unpacked. This can lead to privilege escalation or arbitrary code execution by making system scripts writable. The issue has been patched in version 0.46.2.