Python Wheel (Zip) Parser Differential Vulnerability v2.0

### Summary It is still possible (albeit with significantly more effort) to upload a specially crafted Wheel file (i.e. zip) to PyPI that when installed with PIP (or another Python zipfile based tool) a package is installed that behaves one way, and when installed by a non-Python tool (particularly uv) a package is installed that behaves another way. This vulnerability continues to exist because the zip specification is incredibly complex and sufficiently ambiguous that having any two zip parsers behave in a way that prevents differential based attacks is difficult. As before, the security implications of this capability are concerning, as: A benign payload can be delivered specifically to Python users, while uv users receive a malicious payload. A malicious payload can be served to Python users, while security companies and analyzers built on non-Python parsers may see a benign payload. After previous reports, both [PyPI](https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks/) and [UV](https://astral.sh/blog/uv-security-advisory-cve-2025-54368) (CVE-2025-54368) made large gains in protecting the Python ecosystem from this vulnerability. However, after auditing the changes, multiple bugs and behaviour differences present in both UV, PyPI's validation and the Python zipfile library that still allow for Wheel differential attacks. ### Severity Moderate - This vulnerability can be leveraged to hide malicious payloads that evade detection. ### Proof of Concept Using PIP to install the package: ```python $ pip install cbwheeldiff2 Collecting cbwheeldiff2 Downloading cbwheeldiff2-0.0.1-py2.py3-none-any.whl.metadata (148 bytes) Downloading cbwheeldiff2-0.0.1-py2.py3-none-any.whl (1.4 kB) Installing collected packages: cbwheeldiff2 Successfully installed cbwheeldiff2-0.0.1 $ python3 Python 3.12.3 (main, May 26 2025, 18:50:19) [GCC 13.3.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import cbwheeldiff2 I was installed using Python's zipfile. >>> ``` Using UV to install the package: ```python $ uv pip install cbwheeldiff2 Using Python 3.12.3 environment at: env Resolved 1 package in 424ms Prepared 1 package in 201ms Installed 1 package in 1ms + cbwheeldiff2==0.0.1 $ python3 Python 3.12.3 (main, May 26 2025, 18:50:19) [GCC 13.3.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import cbwheeldiff2 I was installed with UV. It's so fast!! >>> ``` In essence, the package `cbwheeldiff2` can be viewed as two interleaved zipfiles, specifically designed to pass the stricter validation introduced earlier in 2025, and to still extract cleanly with UV and PIP (and other Python libraries). Below is an overview of how each implementation sees the zip, and how the records are interleaved. <meta charset="utf-8"><b style="font-weight:normal;" id="docs-internal-guid-d8c84fd2-7fff-26d3-6551-4ee1b9ae0a8a"><div dir="ltr" style="margin-left:0pt;" align="center"> <table> <tr> <th>POS</th> <th>UV</th> <th>Python zipfile</th> <th>PyPI validation</th> </tr> <tr> <td>1</td> <td> LF: &quot;dist/METADATA&quot; </td> <td> LF: &quot;dist/METADATA&quot; </td> <td> LF: &quot;dist/METADATA&quot; </td> </tr> <tr> <td> 2 </td> <td> METADATA content </td> <td> METADATA content </td> <td> Skip content </td> </tr> <tr> <td> 3 </td> <td> LF: &quot;dist/WHEEL&quot; </td> <td> LF: &quot;dist/WHEEL&quot; </td> <td> LF: &quot;dist/WHEEL&quot; </td> </tr> <tr> <td> 4

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-w97x-xxj5-gpjx
• github.com/google/security-research