pip vulnerabilities (PyPI)

13 vulnerabilities.

• pip PyPI pip absolute path traversal during download from malicious package indexes CVE-2026-13346 Fix available 5.6 MediumJuly 29, 2026
• pip PyPI pip can extract console_scripts and gui_scripts outside installation directory CVE-2026-8643 Fix available 4.1 MediumMay 28, 2026
• pip PyPI pip self-update functionality can import newly installed modules after wheel installation CVE-2026-6357 Fix available 5.3 MediumApril 27, 2026
• pip PyPI pip doesn't reject concatenated ZIP and tar archives CVE-2026-3219 Fix available 4.6 MediumApril 20, 2026
• pip PyPI Limited path traversal when installing wheel archives CVE-2026-1703 Fix available 2.0 LowFebruary 2, 2026
• pip PyPI Fallback tar extraction in pip doesn't check symbolic links point to extraction directory CVE-2025-8869 Fix available 5.9 MediumSeptember 24, 2025
• pip PyPI Mercurial configuration injectable in repo revision when installing via pip CVE-2023-5752 Fix available 5.5 MediumOctober 24, 2023
• pip PyPI Improper Input Validation in pip CVE-2021-3572 Public exploitFix available 5.7 MediumJuly 13, 2021
• pip PyPI Path Traversal in pip CVE-2019-20916 Fix available 7.5 HighSeptember 4, 2020
• pip PyPI Improper Authentication in pip CVE-2013-5123 Public exploitFix available 5.9 MediumMay 3, 2015
• pip PyPI pip lack of randomness in build directory CVE-2014-8991 Fix available 2.1 LowNovember 24, 2014
• pip PyPI Improper Link Resolution Before File Access in pip CVE-2013-1888 Fix available 2.1 LowAugust 16, 2013
• pip PyPI Improper Input Validation in pip CVE-2013-1629 Fix available 6.8 MediumAugust 6, 2013