CVE-2026-6357

Medium

Description

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

SeverityMedium

CVSS5.3

Exploit probability—

ProductPip

PublishedApr 27, 2026

First seenApr 27, 2026

Weakness typeCWE-829CWE-829

How to fix

Update

pip26.1 or later

Patches

github.com/pypa/pip/pull/13923

Vendor advisories

ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes

Affected products

Product	Affected versions	Fixed in
pipPyPI	v < 26.1	26.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.