CVE-2025-59042
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-09

Last updated on: 2025-09-11

Assigner: GitHub, Inc.

Description
PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to `sys.path` during the bootstrap process of a PyInstaller-frozen application, and due to the bootstrap script attempting to load an optional module for bytecode decryption while this entry is still present in `sys.path`, an application built with PyInstaller < 6.0.0 may be tricked by an unprivileged attacker into executing arbitrary python code when **all** of the following conditions are met. First, the application is built with PyInstaller < 6.0.0; both onedir and onefile mode are affected. Second, the optional bytecode encryption code feature was not enabled during the application build. Third, the attacker can create files/directories in the same directory where the executable is located. Fourth, the filesystem supports creation of files/directories that contain `?` in their name (i.e., non-Windows systems). Fifth, the attacker is able to determine the offset at which the PYZ archive is embedded in the executable. The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the `setuid` bit set), the code in the injected module is also executed with the said elevated privileges, resulting in a local privilege escalation. PyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using `sys.path` for transmitting location of the PYZ archive, which further eliminates the possibility of described injection procedure. If upgrading PyInstaller is not feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with `setuid` bit set) should mitigate the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-09
Last Modified
2025-09-11
Generated
2026-05-07
AI Q&A
2025-09-10
EPSS Evaluated
2026-05-05
NVD
CVE-2025-59042
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
pyinstaller pyinstaller <6.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects PyInstaller versions before 6.0.0. PyInstaller bundles Python applications into a single package, but during the bootstrap process, it appends a special entry to sys.path and tries to load an optional module for bytecode decryption. If the bytecode encryption feature was not enabled, an attacker who can create files or directories next to the executable (on non-Windows systems that allow '?' in filenames) and can determine the offset of the embedded PYZ archive can create a specially named directory or zip archive containing a malicious Python module. This module will be loaded and executed by the bootstrap script, leading to arbitrary code execution without modifying the executable. If the executable runs with elevated privileges, this can lead to local privilege escalation.


How can this vulnerability impact me? :

This vulnerability can allow an unprivileged attacker to execute arbitrary Python code within the context of the PyInstaller application. If the application runs with elevated privileges (e.g., setuid bit set), the attacker can escalate their privileges locally, potentially gaining higher access on the system. This can lead to unauthorized actions, data compromise, or system control.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, immediately ensure that executables built with PyInstaller versions prior to 6.0.0 do not have writable directories next to them by unprivileged users, especially if the executables have elevated privileges (e.g., setuid bit set). Restrict permissions on directories containing these executables to prevent attackers from creating files or directories that could be used to inject malicious Python modules. Additionally, upgrade PyInstaller to version 6.0.0 or later, as these versions have removed the vulnerable bytecode encryption feature and reworked the bootstrap process to eliminate this attack vector.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart