Medium severity5.9NVD Advisory· Published Jul 29, 2026· Updated Sep 10, 2026
CVE-2026-50558
CVE-2026-50558
Description
Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
penelope-shell-handlerPyPI | < 0.20.0 | 0.20.0 |
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.