CVE Feed

    Dashboard / CVE / CVE-2026-8643

    CVE-2026-8643

    pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

    Published:May 27, 2026
    Last Modified:Aug 28, 2026
    EPS:Jun 1, 2026
    EPSS Score:0.0032
    CVSS Score:5.5

    Affected Products

    Vendor
    Pypa
    Product
    Pip

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-13346 (CVSS 5.6) — pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to ar…
    CVE-2026-6357 (CVSS 5.3) — pip prior to version 26.1 would run self-update check functionality after installing wheel files which require…
    CVE-2023-5752 (CVSS 5.5) — When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the sp…
    CVE-2021-3572 (CVSS 5.7) — A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker c…
    CVE-2018-20225 (CVSS 7.8) — An issue was discovered in pip (all versions) because it installs the version with the highest version number,…
    CVE-2019-20916 (CVSS 7.5) — The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, b…
    CVE-2014-8991 (CVSS 2.1) — pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by …
    CVE-2013-1888 (CVSS 2.1) — pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-…
    CVE-2013-1629 (CVSS 6.8) — pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks …
    CVE-2013-5123 (CVSS 5.9) — The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity…

    References

    https://github.com/pypa/pip/pull/14000
    https://mail.python.org/archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/
    http://www.openwall.com/lists/oss-security/2026/06/01/5
    https://access.redhat.com/errata/RHSA-2026:33313
    https://access.redhat.com/errata/RHSA-2026:34374
    https://access.redhat.com/errata/RHSA-2026:34456
    https://access.redhat.com/errata/RHSA-2026:34739
    https://access.redhat.com/errata/RHSA-2026:34740
    https://access.redhat.com/errata/RHSA-2026:34741
    https://access.redhat.com/errata/RHSA-2026:34748
    https://access.redhat.com/errata/RHSA-2026:34749
    https://access.redhat.com/errata/RHSA-2026:34750
    https://access.redhat.com/errata/RHSA-2026:34752
    https://access.redhat.com/errata/RHSA-2026:34756
    https://access.redhat.com/errata/RHSA-2026:34758
    https://access.redhat.com/errata/RHSA-2026:34760
    https://access.redhat.com/errata/RHSA-2026:34765
    https://access.redhat.com/errata/RHSA-2026:34772
    https://access.redhat.com/errata/RHSA-2026:34773
    https://access.redhat.com/errata/RHSA-2026:34774
    https://access.redhat.com/errata/RHSA-2026:34775
    https://access.redhat.com/errata/RHSA-2026:34776
    https://access.redhat.com/errata/RHSA-2026:34777
    https://access.redhat.com/errata/RHSA-2026:34778
    https://access.redhat.com/errata/RHSA-2026:34780
    https://access.redhat.com/errata/RHSA-2026:34891
    https://access.redhat.com/errata/RHSA-2026:36193
    https://access.redhat.com/errata/RHSA-2026:36315
    https://access.redhat.com/errata/RHSA-2026:37275
    https://access.redhat.com/errata/RHSA-2026:37283
    https://access.redhat.com/errata/RHSA-2026:42078
    https://access.redhat.com/errata/RHSA-2026:42079
    https://access.redhat.com/errata/RHSA-2026:42132
    https://access.redhat.com/errata/RHSA-2026:42144
    https://access.redhat.com/errata/RHSA-2026:42644
    https://access.redhat.com/errata/RHSA-2026:50479
    https://access.redhat.com/errata/RHSA-2026:54760
    https://access.redhat.com/errata/RHSA-2026:56347
    https://access.redhat.com/errata/RHSA-2026:60520
    https://access.redhat.com/security/cve/CVE-2026-8643
    https://bugzilla.redhat.com/show_bug.cgi?id=2460927
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High