AIKIDO-2026-341925
pyinstaller is vulnerable to Privilege Escalation
78
High Risk
This Affects:
pyinstallerTL;DR
The bootloader passes execution state between parent and child processes through environment variables such as _MEIPASS2 and _PYI_* without validating them. A local unprivileged user can spoof these variables when launching a frozen application that runs with elevated privileges to load arbitrary code or delete protected directories as the privileged user. On POSIX systems this can also remove directories outside the application's control. The fix verifies that the parent process executable matches, validates the temporary directory naming, and for setuid executables requires the runtime directory to be owned by the effective user with 0700 permissions.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you distribute a PyInstaller-built application that runs with elevated privileges, such as a setuid-root executable on POSIX or a UAC-elevated executable on Windows.
Background info
pyinstaller is vulnerable to Privilege Escalation in versions 0.0.1 - 6.22.0.
How to fix this
Upgrade the pyinstaller library to the patch version and rebuild any distributed applications that run with elevated privileges.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant