PyInstaller — Vulnerabilities & Security Advisories 3

PyInstaller is primarily used to package Python applications into standalone executables, simplifying distribution. Historically, it has been associated with remote code execution vulnerabilities, often stemming from insecure handling of extracted files or path traversal issues during unpacking. Other common classes include privilege escalation through insecure default permissions and cross-site scripting in bundled web components. While no major public incidents have been widely documented, the three recorded CVEs highlight risks in file extraction and path handling, particularly when processing untrusted input. Security researchers note that its use in bundling third-party dependencies can introduce additional attack surfaces if not properly sanitized.