CVE-2026-3219

The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.

A vulnerability in pip prior to version 23.3 allows injecting arbitrary configuration options into the 'hg clone' call when installing a package from a Mercurial VCS URL (hg+...). An attacker can control Mercurial configuration, modifying how and what is cloned.

pip incorrectly handles doubly-encoded package URLs from indexes, allowing files to be installed to arbitrary disk locations when installing wheels. This vulnerability requires downloading or installing a package from a malicious index; malicious packages alone cannot exploit it.

In pip, console_scripts and gui_scripts were treated as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

When extracting a tar archive, pip may not check that symbolic links point into the extraction directory if the tarfile module does not implement PEP 706. This vulnerability only affects Python versions that do not implement PEP 706, and upgrading pip alone does not fix all tarfile-related issues. It is recommended to use a Python version with PEP 706 or a patched pip.