debian/wheel vulnerabilities

Latest debian/wheel CVEs

Newest publication first

1. CVE-2026-24049 wheel Allows Arbitrary File Permission Modification via Path Traversal

   Published 2026-01-22

   Medium·CVSS 5.5 EPSS 0.35%

   wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the fil...

2. CVE-2022-40898 pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)

   Published 2022-12-22

   High·CVSS 7.5 EPSS 2.8%

   An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.