gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591)
Use ZipFile.extractall() to sanitize file names and extract files. Files with invalid names (e.g. absolute paths) are now skipped. Files containing ".." in the name are no longer skipped.
S
Serhiy Storchaka committed
fc829e88753858c8ac669594bf0093f44948c0f4
Parent: 3e5a3cb
Committed by GitHub <noreply@github.com>
on 4/27/2026, 6:43:15 PM