CVE Feed

    Dashboard / CVE / CVE-2026-6357

    CVE-2026-6357

    pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

    Published:Apr 27, 2026
    Last Modified:Apr 28, 2026
    EPS:Apr 27, 2026
    EPSS Score:0.00016
    CVSS Score:5.8

    Affected Products

    Vendor
    Pypa
    Product
    Pip

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-13346 (CVSS 5.6) — pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to ar…
    CVE-2026-8643 (CVSS 4.1) — pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved…
    CVE-2023-5752 (CVSS 5.5) — When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the sp…
    CVE-2021-3572 (CVSS 5.7) — A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker c…
    CVE-2018-20225 (CVSS 7.8) — An issue was discovered in pip (all versions) because it installs the version with the highest version number,…
    CVE-2019-20916 (CVSS 7.5) — The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, b…
    CVE-2014-8991 (CVSS 2.1) — pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by …
    CVE-2013-1888 (CVSS 2.1) — pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-…
    CVE-2013-1629 (CVSS 6.8) — pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks …
    CVE-2013-5123 (CVSS 5.9) — The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High