Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-01 | 2 | Patch2 |
| 2026-02-03 | 1 | Patch1 |
Just published a detailed analysis on the critical #openSUSE Leap 16.0 patch for CVE-2026-24049. This isn't just another bug fix. Read more: 👉 https://tinyurl.com/4b5ebsx6 #Security https://t.co/Lj1uhqXuKX
Post summary
The tweet announces a detailed analysis of the critical patch for CVE‑2026‑24049 on openSUSE Leap 16.0, emphasizing its importance without providing exploit details.
CVE-2026-24049 patched in Python wheel manipulation tools affecting Spyder 43 flask-bundle and Ubuntu 22 python-package. Admins should update CLI wheel tooling promptly. #Vulnerability https://threatcluster.io/cluster/security-vulnerability-in-python-wheel-manipulation-tools-ad-bd38b921
Post summary
The post announces that CVE-2026‑24049 has been patched in Python wheel manipulation tools impacting Spyder 43 and Ubuntu 22, and urges administrators to update their CLI wheel tooling to mitigate the issue.
Fedora 42 and 43 fix critical privilege escalation in mingw-python-wheel, CVE-2026-24049, with version 0.46.3 released January 22, 2026 by Sandro Mani. Users should update promptly. https://threatcluster.io/cluster/fedora-42-and-43-mingw-python-wheel-critical-privilege-escal-4371530b
Post summary
Fedora 42 and 43 now contain a patch for CVE-2026-24049, a privilege escalation flaw in mingw-python-wheel. Users are urged to update to the latest 0.46.3 release to mitigate the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wheel_project | wheel | - | python | - |