pypa / pipx

Install and Run Python Applications in Isolated Environments
https://pipx.pypa.io
MIT License
10.64k stars 418 forks source link

pipx includes current working dir in import path during install #1575

Open GUIpsp opened 2 weeks ago

GUIpsp commented 2 weeks ago

Describe the bug

pipx install considers the current working dir as import path during install.

How to reproduce

cd $(mktemp -d)
echo "raise" > re.py
pipx install magic-wormhole # or anything else, really

Expected behavior Pipx installs the package, ignoring cwd

Actual behavior Pipx errors out, because of the file in cwd

Extra

This probably has some security implications, but I could not find anywhere specific to report security issues, and it's probably low severity anyways.