pyinstaller
PyInstaller bundles a Python application and all its dependencies into a single package.
Activity
- Latest release
- 1d ago
- Total releases
- 74
- Cadence
- ~28 days
- Last 12 months
- 9
Details
- License
- custom
- First release
- Sep 28, 2012
| Version | Released | |
|---|---|---|
6.22.3
patch
|
6.22.3
patch
Dependencies (12)
+ 4 more |
|
6.22.2
patch
|
6.22.2
patch
Dependencies (12)
+ 4 more |
|
6.22.1
patch
|
6.22.1
patch
Dependencies (12)
+ 4 more |
|
6.22.0
minor
|
6.22.0
minor
Dependencies (12)
+ 4 more |
|
6.21.0
minor
|
6.21.0
minor
Dependencies (12)
+ 4 more |
|
6.20.0
minor
|
6.20.0
minor
Dependencies (12)
+ 4 more |
|
6.19.0
minor
|
6.19.0
minor
Dependencies (12)
+ 4 more |
|
6.18.0
minor
|
6.18.0
minor
Dependencies (12)
+ 4 more |
|
6.17.0
minor
|
6.17.0
minor
Dependencies (12)
+ 4 more |
|
6.16.0
minor
|
6.16.0
minor
Dependencies (12)
+ 4 more |
|
6.15.0
minor
|
6.15.0
minor
Dependencies (12)
+ 4 more |
|
6.14.2
patch
|
6.14.2
patch
Dependencies (12)
+ 4 more |
|
6.14.1
patch
|
6.14.1
patch
Dependencies (12)
+ 4 more |
|
6.14.0
minor
|
6.14.0
minor
Dependencies (12)
+ 4 more |
|
6.13.0
minor
|
6.13.0
minor
Dependencies (12)
+ 4 more |
|
6.12.0
minor
|
6.12.0
minor
Dependencies (12)
+ 4 more |
|
6.11.1
patch
|
6.11.1
patch
Dependencies (12)
+ 4 more |
|
6.11.0
minor
|
6.11.0
minor
Dependencies (12)
+ 4 more |
|
6.10.0
minor
|
6.10.0
minor
Dependencies (12)
+ 4 more |
|
6.9.0
minor
|
6.9.0
minor
Dependencies (12)
+ 4 more |
|
6.8.0
minor
|
6.8.0
minor
Dependencies (12)
+ 4 more |
|
6.7.0
minor
|
6.7.0
minor
Dependencies (12)
+ 4 more |
|
6.6.0
minor
|
6.6.0
minor
Dependencies (12)
+ 4 more |
|
6.5.0
minor
|
6.5.0
minor
Dependencies (12)
+ 4 more |
|
6.4.0
minor
|
6.4.0
minor
Dependencies (12)
+ 4 more |
|
6.3.0
minor
|
6.3.0
minor
Dependencies (12)
+ 4 more |
|
6.2.0
minor
|
6.2.0
minor
Dependencies (12)
+ 4 more |
|
6.1.0
minor
|
6.1.0
minor
Dependencies (11)
+ 3 more |
|
6.0.0
major
|
6.0.0
major
Dependencies (11)
+ 3 more |
|
5.13.2
patch
1 CVE
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev |
5.13.2
patch
Dependencies (11)
+ 3 more |
|
5.13.1
patch
1 CVE
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev |
5.13.1
patch
Dependencies (11)
+ 3 more |
|
5.13.0
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.13.0
minor
Dependencies (11)
+ 3 more |
|
5.12.0
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.12.0
minor
Dependencies (11)
+ 3 more |
|
5.11.0
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.11.0
minor
Dependencies (11)
+ 3 more |
|
5.10.1
patch
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.10.1
patch
Dependencies (11)
+ 3 more |
|
5.10.0
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.10.0
minor
Dependencies (11)
+ 3 more |
|
5.9.0
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.9.0
minor
Dependencies (11)
+ 3 more |
|
5.8.0
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.8.0
minor
Dependencies (11)
+ 3 more |
|
5.7.0
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.7.0
minor
Dependencies (11)
+ 3 more |
|
5.6.2
patch
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.6.2
patch
Dependencies (11)
+ 3 more |
|
5.6.1
patch
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.6.1
patch
Dependencies (11)
+ 3 more |
|
5.6
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.6
minor
Dependencies (11)
+ 3 more |
|
5.5
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.5
minor
Dependencies (11)
+ 3 more |
|
5.4.1
patch
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.4.1
patch
Dependencies (11)
+ 3 more |
|
5.4
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.4
minor
Dependencies (11)
+ 3 more |
|
5.3
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.3
minor
Dependencies (11)
+ 3 more |
|
5.2
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.2
minor
Dependencies (11)
+ 3 more |
|
5.1
minor
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.1
minor
Dependencies (11)
+ 3 more |
|
5.0.1
patch
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.0.1
patch
Dependencies (11)
+ 3 more |
|
5.0
major
2 CVEs
CVE-2025-59042
PYSEC-2026-1813
GHSA-p2xp-xx3r-mffc
Jul 07, 2026
PyInstaller has local privilege escalation vulnerability
Critical
Local
Low
Low
ImpactDue to a special entry being appended to
The attacker can create a directory (or a zip archive) next to the executable, with the name that matches the format used by PyInstaller's bootloader to transmit information about the location of PYZ archive to the bootstrap script. If this directory (or zip archive) contains a python module whose name matches the name used by the optional bytecode encryption feature, this module will be loaded and executed by the bootstrap script (in the absence of the real, built-in module that is available when the bytecode-encryption feature is enabled). This results in arbitrary code execution that requires no modification of the executable itself. If the executable is running with elevated privileges (for example, due to having the PatchesPyInstaller 6.0.0 (f5adf291c8b832d5aff7632844f7e3ddf7ad4923) removed support for bytecode encryption; this effectively removes the described attack vector, due to the bootstrap script not attempting to load the optional module for bytecode-decryption anymore. PyInstaller 6.10.0 (cfd60b510f95f92cb81fc42735c399bb781a4739) reworked the bootstrap process to avoid (ab)using WorkaroundsIf upgrading PyInstaller is no feasible, this issue can be worked around by ensuring proper permissions on directories containing security-sensitive executables (i.e., executables with Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 35 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
6.0.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49797
PYSEC-2023-292
GHSA-9w2p-rh8c-v9g5
Dec 09, 2023
7.8
/ 10
High
Local
Low
Low
None
Unchanged
High
High
High
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either Affected versions
1.5
1.5.1
2.0
2.1
3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
+ 33 more Show less
3.5
3.6
4.0
4.1
4.10
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
5.0
5.0.1
5.1
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
Fixed in
5.13.1
References
Updated Nov 21, 2024 · Source: OSV.dev |
5.0
major
Dependencies (11)
+ 3 more |