CVE-2013-1888
Improper Link Resolution Before File Access in pip
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
Exploit likelihood
What each source reports
NVD Score used
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
- Record
CVE-2013-1888- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
- Record
CVE-2013-1888- Updated
- 2026-11-02
EUVDEUVD-2013-0026 No score
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
- Record
EUVD-2013-0026- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4gv5-qhvr-36vv
Improper Link Resolution Before File Access in pip
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
- Record
GHSA-4gv5-qhvr-36vv- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVGHSA-4gv5-qhvr-36vv
Improper Link Resolution Before File Access in pip
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
- Record
GHSA-4gv5-qhvr-36vv- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVPYSEC-2013-9 No score
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
- Record
PYSEC-2013-9- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1888 is a low vulnerability (CVSS 2.1) in Pypa Pip, published August 16, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in pip 1.3.