setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

Summary On Windows, attacker-controlled content in a wheel's .dist-info/namespacepackages.txt can cause setuptools' legacy wheel installation path to create an init.py outside the requested destinationeggdir. The attacker can influence the destination path, but not the contents of the created fil...