Python Packaging Authority Pip
5 CVEs affecting Python Packaging Authority Pip. Latest disclosed: 2026-07-29. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13346 | Medium | 6.5 | 2026-07-29 | pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wh… |
CVE-2026-8643 | Medium | 5.5 | 2026-06-01 | pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, lea… |
CVE-2026-3219 | | 2026-04-20 | pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in conf… | |
CVE-2026-1703 | | 2026-02-02 | When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is lim… | |
CVE-2025-8869 | | 2025-09-24 | When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that u… |