{"cve":"CVE-2023-49797","nvd":{"published":"2023-12-09T01:15:07.333","modified":"2026-06-17T06:36:29.110","status":"Modified","description":"PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-732","CWE-379"],"references":["https://github.com/pyinstaller/pyinstaller/pull/7827","https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5","https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2K2XIQLEMZIKUQUOWNDYWTEWYQTKMAN7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRWT34FAF23PUOLVZ7RVWBZMWPDR5U7/"],"products":["pyinstaller:pyinstaller"],"source":"nvd","synced_at":"2026-10-19T21:42:34.585441961+00:00"},"epss":{"cve":"CVE-2023-49797","score":0.00324,"percentile":0.25528,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9w2p-rh8c-v9g5","url":"https://osv.dev/vulnerability/GHSA-9w2p-rh8c-v9g5","summary":"Local Privilege Escalation in Windows","modified":"2024-11-22T20:33:42.273183Z","packages":[{"ecosystem":"PyPI","name":"pyinstaller","purl":"pkg:pypi/pyinstaller","ranges":["<5.13.1"],"fixed":["5.13.1"]}]},{"id":"PYSEC-2023-292","url":"https://osv.dev/vulnerability/PYSEC-2023-292","summary":"","modified":"2024-11-21T14:56:57.538134Z","packages":[{"ecosystem":"PyPI","name":"pyinstaller","purl":"pkg:pypi/pyinstaller","ranges":["<5.13.1"],"fixed":["5.13.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}