From 7ff8bdd81ec5edca2bebf78ad8506dda710d6af5 Mon Sep 17 00:00:00 2001 From: Damian Shaw Date: Mon, 18 May 2026 23:22:51 -0400 Subject: [PATCH] Fix is_within_directory for doubled-slash roots CVE: CVE-2026-8643 Upstream-Status: Backport [https://github.com/pypa/pip/commit/7ff8bdd81ec5edca2bebf78ad8506dda710d6af5] Backport Changes: - Omitted tests/unit/test_utils_unpacking.py because the pip 26.0.1 PyPI sdist used by this recipe does not ship the upstream tests directory. (cherry picked from commit 7ff8bdd81ec5edca2bebf78ad8506dda710d6af5) Signed-off-by: Hetvi Thakar --- src/pip/_internal/utils/unpacking.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py index 879b40c37e..ba7cb52579 100644 --- a/src/pip/_internal/utils/unpacking.py +++ b/src/pip/_internal/utils/unpacking.py @@ -83,8 +83,7 @@ def is_within_directory(directory: str, target: str) -> bool: abs_directory = os.path.abspath(directory) abs_target = os.path.abspath(target) - prefix = os.path.commonpath([abs_directory, abs_target]) - return prefix == abs_directory + return abs_target == abs_directory or abs_target.startswith(abs_directory + os.sep) def _get_default_mode_plus_executable() -> int: -- 2.35.6