AIKIDO-2026-11060

TL;DR

The ScriptMaker class in distlib.scripts constructs the output path for generated script wrappers by joining the target scripts directory with the entry point name and writing the result without verifying it stays inside the target directory. A package whose entry point metadata contains crafted names with parent-directory segments can cause an installer that uses distlib to write the wrapper outside the intended scripts directory, overwriting arbitrary files with the installing user's privileges. Version 0.4.1 resolves the candidate path to an absolute path and raises DistlibException when it falls outside the target directory.