Threats tagged 'brew-gobject-introspection-cve-2025-47273'

A path traversal vulnerability in setuptools' PackageIndex.download function allows an attacker to write files to arbitrary filesystem locations. This occurs due to insufficient sanitization of URL-derived filenames, enabling os.path.join to be bypassed. The flaw was fixed in setuptools version 1.84.0_1. Exploitation could lead to arbitrary file writes and potentially remote code execution depending on the execution context.