Every CVE Search/ Get API key

CVE-2018-20225

An issue was discovered in pip (all versions) because it installs the version with the highest...

7.8 HighPublic exploitFix availableDisputed

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.78%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Record
CVE-2018-20225
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List 7.8

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Record
CVE-2018-20225
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2018-12792 7.8

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Record
EUVD-2018-12792
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-7p5p-7qq5-cc86 No score

An issue was discovered in pip (all versions) because it installs the version with the highest...

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number).

Record
GHSA-7p5p-7qq5-cc86
Updated
2026-11-02
OSVDEBIAN-CVE-2018-20225 7.8

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Record
DEBIAN-CVE-2018-20225
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-20225 7.8

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Record
UBUNTU-CVE-2018-20225
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2018-20225 No score

CVE-2018-20225 in python-pip - Patched by Root

Root has patched CVE-2018-20225 in the python-pip package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2018-20225
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-pip
Root:Debian:12
 before 23.0.1+dfsg-1.aikido.4
23.0.1+dfsg-1.aikido.423.0.1+dfsg-1.root.io.123.0.1+dfsg-1.root.io.323.0.1+dfsg-1.root.io.2
rootio-python-pip
Root:Debian:12
 before 23.0.1+dfsg-1.aikido.4
23.0.1+dfsg-1.aikido.423.0.1+dfsg-1.root.io.123.0.1+dfsg-1.root.io.323.0.1+dfsg-1.root.io.2
python-pip
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.4.1-21.5.4-11.5.4-1ubuntu11.5.4-1ubuntu31.5.4-1ubuntu4
Show 5 moreShow less
1.5.4-1ubuntu4+esm11.5.4-1ubuntu4+esm21.5.4-1ubuntu4+esm31.5.4-1ubuntu4+esm41.5.4-1ubuntu4+esm5
 None known
python-pip
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.6-7ubuntu11.5.6-7ubuntu28.0.2-78.0.3-18.0.3-2
Show 17 moreShow less
8.1.0-18.1.0-28.1.1-18.1.1-28.1.1-2ubuntu0.18.1.1-2ubuntu0.28.1.1-2ubuntu0.48.1.1-2ubuntu0.68.1.1-2ubuntu0.6+esm28.1.1-2ubuntu0.6+esm38.1.1-2ubuntu0.6+esm48.1.1-2ubuntu0.6+esm58.1.1-2ubuntu0.6+esm68.1.1-2ubuntu0.6+esm88.1.1-2ubuntu0.6+esm108.1.1-2ubuntu0.6+esm118.1.1-2ubuntu0.6+esm12
 None known
python-pip
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.1-29.0.1-2.3~ubuntu19.0.1-2.3~ubuntu1.18.04.19.0.1-2.3~ubuntu1.18.04.29.0.1-2.3~ubuntu1.18.04.3
Show 15 moreShow less
9.0.1-2.3~ubuntu1.18.04.49.0.1-2.3~ubuntu1.18.04.59.0.1-2.3~ubuntu1.18.04.5+esm29.0.1-2.3~ubuntu1.18.04.5+esm39.0.1-2.3~ubuntu1.18.04.69.0.1-2.3~ubuntu1.18.04.6+esm19.0.1-2.3~ubuntu1.18.04.79.0.1-2.3~ubuntu1.18.04.7+esm19.0.1-2.3~ubuntu1.18.04.89.0.1-2.3~ubuntu1.18.04.8+esm19.0.1-2.3~ubuntu1.18.04.8+esm29.0.1-2.3~ubuntu1.18.04.8+esm49.0.1-2.3~ubuntu1.18.04.8+esm69.0.1-2.3~ubuntu1.18.04.8+esm79.0.1-2.3~ubuntu1.18.04.8+esm8
 None known
python-pip
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
18.1-518.1-5build118.1-5ubuntu120.0.2-220.0.2-4
Show 16 moreShow less
20.0.2-520.0.2-5ubuntu120.0.2-5ubuntu1.120.0.2-5ubuntu1.320.0.2-5ubuntu1.420.0.2-5ubuntu1.520.0.2-5ubuntu1.620.0.2-5ubuntu1.720.0.2-5ubuntu1.820.0.2-5ubuntu1.920.0.2-5ubuntu1.1020.0.2-5ubuntu1.10+esm220.0.2-5ubuntu1.1120.0.2-5ubuntu1.11+esm220.0.2-5ubuntu1.11+esm320.0.2-5ubuntu1.11+esm4
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubbrabster/cve-2018-202252025-12-05

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-20225 is a high vulnerability (CVSS 7.8) in Pypa Pip, published May 8, 2020. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.78%, the 78th percentile. Fixed in python-pip 23.0.1+dfsg-1.aikido.4.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open