CVE-2019-20916
HighSummary
The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.
Risk Assessment
The risk involves the potential remote overwriting of critical system files like SSH keys, which could lead to unauthorized server access and privilege escalation.
Recommendation
Immediately upgrade pip to version 19.2 or later. If an upgrade is not possible, avoid installing packages from untrusted URLs.
Other vulnerabilities in pip
See all- CVE-2023-5752Low
A vulnerability in pip prior to version 23.3 allows injecting arbitrary configuration options into the 'hg clone' call when installing a package from a Mercurial VCS URL (hg+...). An attacker can control Mercurial configuration, modifying how and what is cloned.
- CVE-2026-13346Medium
pip incorrectly handles doubly-encoded package URLs from indexes, allowing files to be installed to arbitrary disk locations when installing wheels. This vulnerability requires downloading or installing a package from a malicious index; malicious packages alone cannot exploit it.
- CVE-2026-8643Medium
In pip, console_scripts and gui_scripts were treated as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Original NVD description (English source)
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py