CVE-2026-8643
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In pip, console_scripts and gui_scripts were treated as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Risk Assessment
This can lead to executable files being placed in unexpected locations, potentially allowing an attacker to execute malicious code or bypass security measures.
Recommendation
Update pip to the latest version, which includes a fix for this vulnerability.
Other vulnerabilities in pip
See all- CVE-2019-20916High
The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.
- CVE-2023-5752Low
A vulnerability in pip prior to version 23.3 allows injecting arbitrary configuration options into the 'hg clone' call when installing a package from a Mercurial VCS URL (hg+...). An attacker can control Mercurial configuration, modifying how and what is cloned.
- CVE-2026-13346Medium
pip incorrectly handles doubly-encoded package URLs from indexes, allowing files to be installed to arbitrary disk locations when installing wheels. This vulnerability requires downloading or installing a package from a malicious index; malicious packages alone cannot exploit it.
Original NVD description (English source)
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.