PyInstaller Flaw : Are Your Python Apps Vulnerable to Hijacking?

The PyInstaller project has released fixes for a local privilege escalation vulnerability affecting applications packaged with versions before 6.0.0, tracked as CVE-2025-59042 with a CVSS score of 7.0. The flaw could allow an unprivileged attacker to trigger arbitrary code during the bootstrap process of PyInstaller-frozen applications, potentially executing with elevated rights if the executable runs with such privileges.

The issue stems from a crafted directory or zip archive placed next to the executable that mimics the PYZ archive location, exploiting a special entry appended to sys[.]path during bootstrap; the attack could succeed if certain preconditions are met, including a PyInstaller build of < 6.0.0 and the optional bytecode encryption feature not being enabled.

According to the PyInstaller advisory, the developers addressed the issue in two stages, first removing support for bytecode encryption in 6.0.0 and then hardening the bootstrap process further in 6.10.0 by eliminating the use of sys[.]path for transmitting the PYZ location. For environments where upgrading is not immediately possible, the advisory recommends applying strict directory permissions around elevated-privilege executables and preventing attackers from creating arbitrary files beside sensitive binaries.