Every CVE Search/ Get API key

CVE-2025-8869

Fallback tar extraction in pip doesn't check symbolic links point to extraction directory

5.9 MediumFix available

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.49%Up 0.5 points since Sep 25, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.9

Fallback tar extraction in pip doesn't check symbolic links point to extraction directory

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
CVE-2025-8869
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
EUVDEUVD-2025-30961 5.9

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
EUVD-2025-30961
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4xh5-x5gv-qwph 5.9

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
GHSA-4xh5-x5gv-qwph
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-59
Updated
2026-11-02
NVD 5.9

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
CVE-2025-8869
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSV 5.9

Fallback tar extraction in pip doesn't check symbolic links point to extraction directory

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
CVE-2025-8869
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-8869 5.9

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
DEBIAN-CVE-2025-8869
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 10 moreShow less
OSVGHSA-4xh5-x5gv-qwph 5.9

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
GHSA-4xh5-x5gv-qwph
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-59
Updated
2026-11-02
OSVOESA-2025-2714 5.3

python-pip security update

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-/bash_completion.d}) Name: python-pip Version: 20.2.2 Release: 4 Summary: A tool for installing and managing Python packages License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL: http://www.pip-installer.org Source0: https://files.pythonhosted.org/packages/source/p/pip/pip-.tar.gz BuildArch: noarch Patch1: allow-stripping-given-prefix-from-wheel-RECORD-files. Patch2: emit-a-warning-when-running-with-root-privileges.patch Patch3: remove-existing-dist-only-if-path-conflicts.patch Patch6000: dummy-certifi.patch Patch6001: backport-CVE-2021-3572.patch

Security Fix(es):

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

Record
OESA-2025-2714
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-2741 5.3

python-pip security update

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-/bash_completion.d}) Name: python-pip Version: 20.2.2 Release: 4 Summary: A tool for installing and managing Python packages License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL: http://www.pip-installer.org Source0: https://files.pythonhosted.org/packages/source/p/pip/pip-.tar.gz BuildArch: noarch Patch1: allow-stripping-given-prefix-from-wheel-RECORD-files. Patch2: emit-a-warning-when-running-with-root-privileges.patch Patch3: remove-existing-dist-only-if-path-conflicts.patch Patch6000: dummy-certifi.patch Patch6001: backport-CVE-2021-3572.patch

Security Fix(es):

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

Record
OESA-2025-2741
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-2794 5.3

python-pip security update

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-/bash_completion.d}) Name: python-pip Version: 20.2.2 Release: 4 Summary: A tool for installing and managing Python packages License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL: http://www.pip-installer.org Source0: https://files.pythonhosted.org/packages/source/p/pip/pip-.tar.gz BuildArch: noarch Patch1: allow-stripping-given-prefix-from-wheel-RECORD-files. Patch2: emit-a-warning-when-running-with-root-privileges.patch Patch3: remove-existing-dist-only-if-path-conflicts.patch Patch6000: dummy-certifi.patch Patch6001: backport-CVE-2021-3572.patch

Security Fix(es):

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

Record
OESA-2025-2794
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVPYSEC-2026-1795 5.9

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
PYSEC-2026-1795
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-8869 5.9

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
UBUNTU-CVE-2025-8869
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-67788 No score

CVE-2025-8869 affecting package python-pip for versions less than 24.2-4

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code.

Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Record
AZL-67788
Updated
2026-11-05
OSVCLSA-2026-1788161320 No score

TuxCare security update for pip (4 CVEs)

TuxCare rebuilt pip to address 4 CVEs. Fixed in 9.0.0.post2+tuxcare.

Record
CLSA-2026-1788161320
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2025-8869 No score

CVE-2025-8869 in pip - Patched by Root

Root has patched CVE-2025-8869 in the pip package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2025-8869
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-8869 No score

CVE-2025-8869 in python-pip - Patched by Root

Root has patched CVE-2025-8869 in the python-pip package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2025-8869
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pip
PyPI
 through 25.2
25.3
python-pip
Azure Linux:3
 before 24.2-4
24.2-4
python3
Alpaquita:23
 3.11.3-r0 up to 3.11.4-r0
3.11.4-r0
python3
BellSoft Hardened Containers:23
 3.11.3-r0 up to 3.11.4-r0
3.11.4-r0
pip
TuxCare:PyPI
From an advisory covering 4 CVEs
 9.0 up to 9.0.0.post2+tuxcare, plus listed versions
9.0.post1+tuxcare
9.0.0.post2+tuxcare
python-pip
Debian:12
 All versions, plus listed versions
23.0.1+dfsg-123.1.2+dfsg-123.1.2+dfsg-223.2+dfsg-123.2.1+dfsg-1
Show 17 moreShow less
23.3+dfsg-124.0+dfsg-124.0+dfsg-224.1+dfsg-124.1.1+dfsg-124.2+dfsg-124.3.1+dfsg-125.0+dfsg-125.0.1+dfsg-125.1+dfsg-125.1.1+dfsg-125.2+dfsg-125.3+dfsg-126.0+dfsg-126.0.1+dfsg-126.1.1+dfsg-126.1.2+dfsg-1
 None known
python-pip
Debian:13
 All versions, plus listed versions
25.1.1+dfsg-125.2+dfsg-125.3+dfsg-126.0+dfsg-126.0.1+dfsg-126.1.1+dfsg-126.1.2+dfsg-1
 None known
python-pip
Debian:14
 before 25.3+dfsg-1, plus listed versions
25.1.1+dfsg-125.2+dfsg-1
25.3+dfsg-1
python-pip
Debian:11
From an advisory covering 2 CVEs
 before 20.3.4-4+deb11u2, plus listed versions
20.3.4-420.3.4-4+deb11u1
20.3.4-4+deb11u2
pip
PyPI
 before 25.3, plus listed versions
0.20.2.10.30.3.10.4
Show 45 moreShow less
0.50.5.10.60.6.10.6.20.6.30.70.7.10.7.20.80.8.10.8.20.8.31.01.0.11.0.21.11.21.2.11.31.3.11.41.4.11.51.5.11.5.21.5.31.5.41.5.51.5.610.0.010.0.0b110.0.0b210.0.118.018.119.019.0.119.0.219.0.319.119.1.119.219.2.119.2.2
25.3
Show 10 moreShow less
Affected packages
PackageAffectedFixed
python-pip
openEuler:20.03-LTS-SP4
 before 20.2.2-13.oe2003sp4
20.2.2-13.oe2003sp4
python-pip
openEuler:22.03-LTS-SP4
 before 21.3.1-12.oe2203sp4
21.3.1-12.oe2203sp4
python-pip
openEuler:22.03-LTS-SP3
 before 21.3.1-12.oe2203sp3
21.3.1-12.oe2203sp3
pip
Root:PyPI
 before 25.0.1+aikido.3
25.0.1+aikido.325.2+aikido.424.2+aikido.225.0+aikido.221.2.4+aikido.322.2.1+aikido.323.2.1+aikido.323.1.2+aikido.423.3.1+aikido.223.0.1+aikido.524.0+aikido.422.0.4+aikido.425.0.1+aikido.423.2.1+aikido.422.3.1+aikido.421.2.4+aikido.423.0.1+aikido.625.2+aikido.524.2+aikido.322.0.4+aikido.523.3.1+aikido.324.2+aikido.4
python-pip
Root:Debian:12
 before 23.0.1+dfsg-1.aikido.4
23.0.1+dfsg-1.aikido.423.0.1+dfsg-1.root.io.323.0.1+dfsg-1.root.io.2
rootio-python-pip
Root:Debian:12
 before 23.0.1+dfsg-1.aikido.4
23.0.1+dfsg-1.aikido.423.0.1+dfsg-1.root.io.323.0.1+dfsg-1.root.io.2
python-pip
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.4.1-21.5.4-11.5.4-1ubuntu11.5.4-1ubuntu31.5.4-1ubuntu4
Show 5 moreShow less
1.5.4-1ubuntu4+esm11.5.4-1ubuntu4+esm21.5.4-1ubuntu4+esm31.5.4-1ubuntu4+esm41.5.4-1ubuntu4+esm5
 None known
python-pip
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.6-7ubuntu11.5.6-7ubuntu28.0.2-78.0.3-18.0.3-2
Show 17 moreShow less
8.1.0-18.1.0-28.1.1-18.1.1-28.1.1-2ubuntu0.18.1.1-2ubuntu0.28.1.1-2ubuntu0.48.1.1-2ubuntu0.68.1.1-2ubuntu0.6+esm28.1.1-2ubuntu0.6+esm38.1.1-2ubuntu0.6+esm48.1.1-2ubuntu0.6+esm58.1.1-2ubuntu0.6+esm68.1.1-2ubuntu0.6+esm88.1.1-2ubuntu0.6+esm108.1.1-2ubuntu0.6+esm118.1.1-2ubuntu0.6+esm12
 None known
python-pip
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.1-29.0.1-2.3~ubuntu19.0.1-2.3~ubuntu1.18.04.19.0.1-2.3~ubuntu1.18.04.29.0.1-2.3~ubuntu1.18.04.3
Show 15 moreShow less
9.0.1-2.3~ubuntu1.18.04.49.0.1-2.3~ubuntu1.18.04.59.0.1-2.3~ubuntu1.18.04.5+esm29.0.1-2.3~ubuntu1.18.04.5+esm39.0.1-2.3~ubuntu1.18.04.69.0.1-2.3~ubuntu1.18.04.6+esm19.0.1-2.3~ubuntu1.18.04.79.0.1-2.3~ubuntu1.18.04.7+esm19.0.1-2.3~ubuntu1.18.04.89.0.1-2.3~ubuntu1.18.04.8+esm19.0.1-2.3~ubuntu1.18.04.8+esm29.0.1-2.3~ubuntu1.18.04.8+esm49.0.1-2.3~ubuntu1.18.04.8+esm69.0.1-2.3~ubuntu1.18.04.8+esm79.0.1-2.3~ubuntu1.18.04.8+esm8
 None known
python-pip
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
18.1-518.1-5build118.1-5ubuntu120.0.2-220.0.2-4
Show 16 moreShow less
20.0.2-520.0.2-5ubuntu120.0.2-5ubuntu1.120.0.2-5ubuntu1.320.0.2-5ubuntu1.420.0.2-5ubuntu1.520.0.2-5ubuntu1.620.0.2-5ubuntu1.720.0.2-5ubuntu1.820.0.2-5ubuntu1.920.0.2-5ubuntu1.1020.0.2-5ubuntu1.10+esm220.0.2-5ubuntu1.1120.0.2-5ubuntu1.11+esm220.0.2-5ubuntu1.11+esm320.0.2-5ubuntu1.11+esm4
 None known

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8869 is a medium vulnerability (CVSS 5.9) in Pip Maintainers Pip, published September 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in pip 25.3.

References

Show 11 moreShow less
This page doesn't list everything

Left out here: 101 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open