Repository navigation
Security risk of hidden pth files #113659
Description
"pth files are evil." (Barry Warsaw, #78125)
There is a special kind of evilness:
- pth files allow to execute arbitrary Python code.
- pth files are executed automatically, unlike to normal py files which need explicit import or passing as argument to Python interpreter.
- Some files are hidden by default (in shell and file managers). In particularly dot-files on Posix.
In sum, it increases the risk of executing malicious code. When you receive a handful of files, you, as a cautious person, check their contents before executing. If Python source files are hidden, it's okay, because you saw that nothing suspicious is imported in the files that you execute. But pth files can be executed even if you do not see them and there are no references in visible files.
This issue was first discussed in comments in #113357.
The severity of this issue is not very large, because it requires user interaction to activate. But it increases the risk. I think we should forbid processing hidden pth files.
Linked PRs
- gh-113659: Skip hidden .pth files #113660
- [3.12] gh-113659: Skip hidden .pth files (GH-113660) #114143
- [3.11] gh-113659: Skip hidden .pth files (GH-113660) #114144
- [3.10] gh-113659: Skip hidden .pth files (GH-113660) #114145
- [3.9] gh-113659: Skip hidden .pth files (GH-113660) #114146
- [3.8] gh-113659: Skip hidden .pth files (GH-113660) #114147
Reacted by Tushar Sadhwani
Activity
pythongh-113659: Skip hidden .pth files
gh-113659: Skip hidden .pth files (GH-113660)
pythongh-113659: Skip hidden .pth files (pythonGH-113660)
pythongh-113659: Skip hidden .pth files (pythonGH-113660)
pythongh-113659: Skip hidden .pth files (pythonGH-113660)
[3.9] pythongh-113659: Skip hidden .pth files (pythonGH-113660)
[3.8] pythongh-113659: Skip hidden .pth files (pythonGH-113660)
[3.11] gh-113659: Skip hidden .pth files (GH-113660) (GH-114144)
6 remaining items
pythongh-113659: Skip hidden .pth files (pythonGH-113660)
pythongh-113659: Skip hidden .pth files (pythonGH-113660)
package/python3: security bump to version 3.11.8
package/python3: security bump to version 3.11.8
package/python3: security bump to version 3.11.8
fkhn commentedon Aug 26, 2024
On macOS this subject might take some importance. Apple offer the ability to sync Documents to iCloud. When you do so any element under a ‘dot folder’ is marked as hidden. That means that, the quite frequent default name of
.venvwill cause unexpected behaviour. I have encountered this trouble with a src-layout and pip editable install of a setuptools build. And I can testimony that it is not simple to investigate. see setuptools/issues/4595Hope it was the right place to share that comment.
pythongh-113659: Skip hidden .pth files (pythonGH-113660)
zanieb commentedon Feb 24, 2026
Unfortunately this has also been reported in uv astral-sh/uv#16977
Skipping hidden
.pthfiles seems a bit problematic if macOS background services are going to hide things automatically.olamide226 commentedon Mar 25, 2026
zware commentedon Mar 25, 2026
fix: prepend src/ to sys.path in run.py
fix: prepend src/ to sys.path in run.py
0xIkari commentedon Apr 30, 2026
zware commentedon Apr 30, 2026