CVE-2026-8643
Medium
Description
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
SeverityMedium
CVSS5.5
Exploit probability25. percentile0.3%
ProductPypa Pip
PublishedJun 1, 2026
First seenJun 1, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- pypa pip26.1.2 or later
- pip26.1.2 or later
Vendor advisories
- mail.python.org/archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/
- access.redhat.com/errata/RHSA-2026:42078
- access.redhat.com/errata/RHSA-2026:42079
- access.redhat.com/errata/RHSA-2026:36193
- access.redhat.com/errata/RHSA-2026:36315
- access.redhat.com/errata/RHSA-2026:42144
- access.redhat.com/errata/RHSA-2026:50479
- access.redhat.com/errata/RHSA-2026:34374
- access.redhat.com/errata/RHSA-2026:42132
- access.redhat.com/errata/RHSA-2026:54760
- access.redhat.com/errata/RHSA-2026:33313
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypa pip | v < 26.1.2 | 26.1.2 |
| pipPyPI | v < 26.1.2 | 26.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.