Pypa vulnerabilities

Products

• Virtualenv 22
• Pip 10
• Setuptools 2

Newest

• pypa virtualenv virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) CVE-2026-115586 Fix available 7.1 HighOctober 23, 2026
• pypa virtualenv virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST CVE-2026-113726 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv activation scripts run code from a path that contains a placeholder name CVE-2026-113776 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote CVE-2026-113732 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv bash activate runs commands from an environment name with a backslash before $ CVE-2026-113725 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv: Deletion recovery can change a symlink target's mode CVE-2026-113724 Fix available 4.5 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Bash prompt values can change meaning under older compatibility modes CVE-2026-113723 Fix available 7.1 HighOctober 20, 2026
• pypa virtualenv virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax CVE-2026-113722 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv: Generated files can follow existing destination links CVE-2026-113721 Fix available 4.5 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Seeded files retain permissions from an older cache CVE-2026-113720 Fix available 4.4 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Venv configuration readback can reinterpret path boundaries CVE-2026-113715 Fix available 2.0 LowOctober 20, 2026
• pypa virtualenv virtualenv: Seed replacement does not contain metadata deletion paths CVE-2026-113719 Fix available 4.5 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Xonsh activation literals depend on the script decoding codec CVE-2026-113718 Fix available 7.1 HighOctober 20, 2026
• pypa virtualenv virtualenv: Pip seeding with download omits wheel digest verification CVE-2026-113717 Fix available 2.3 LowOctober 20, 2026
• pypa virtualenv virtualenv: Builtin creation follows linked environment directories CVE-2026-113716 Fix available 4.5 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Downloaded wheel selection and caching precede verification CVE-2026-113714 Fix available 2.3 LowOctober 20, 2026
• pypa virtualenv virtualenv: Temporary app-data can leave dangling seed package links CVE-2026-113713 Fix available 4.4 MediumOctober 20, 2026
• pypa virtualenv virtualenv bash and fish activation scripts execute commands embedded in paths CVE-2026-102925 Fix available 7.8 HighSeptember 18, 2026
• pypa virtualenv virtualenv: Command injection via --prompt in activate.bat (batch activator) CVE-2026-102937 Fix available 7.3 HighSeptember 18, 2026
• pypa virtualenv virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use CVE-2026-102930 Fix available 7.7 HighSeptember 18, 2026
• pypa virtualenv virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection CVE-2026-102938 Fix available 5.8 MediumSeptember 17, 2026
• pip maintainers pip pip absolute path traversal during download from malicious package indexes CVE-2026-13346 Fix available 5.6 MediumJuly 29, 2026
• pypa setuptools setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ CVE-2026-59890 Fix available 6.1 MediumJuly 8, 2026
• pip maintainers pip, red hat exploit intelligence, lightspeed core +34 more +36 more pip can extract console_scripts and gui_scripts outside installation directory CVE-2026-8643 Fix available 4.1 MediumMay 28, 2026
• pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 more wheel Allows Arbitrary File Permission Modification via Path Traversal CVE-2026-24049 Public exploitFix available 7.1 HighJanuary 22, 2026
• pypa virtualenv virtualenv Has TOCTOU Vulnerabilities in Directory Creation CVE-2026-22702 Fix available 4.5 MediumJanuary 10, 2026
• pypa setuptools, debian linux +1 more setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write CVE-2025-47273 Public exploitFix available 7.7 HighMay 17, 2025
• pypa pypa/setuptools, python setuptools +1 more Remote Code Execution in pypa/setuptools CVE-2024-6345 Fix available 8.8 HighJuly 15, 2024
• pip maintainers pip Mercurial configuration injectable in repo revision when installing via pip CVE-2023-5752 Fix available 5.5 MediumOctober 24, 2023
• pypa pipenv, fedoraproject fedora +1 more Pipenv's requirements.txt parsing allows malicious index url in comments CVE-2022-21668 Public exploitFix available 8.0 HighJanuary 10, 2022
• microsoft python-pip, pypa pip, oracle agile product lifecycle management +2 more +4 more Improper Input Validation in pip CVE-2021-3572 Public exploitFix available 5.7 MediumJuly 13, 2021
• pypa pip, debian linux, opensuse leap +2 more +4 more Path Traversal in pip CVE-2019-20916 Fix available 7.5 HighSeptember 4, 2020
• pypa pip An issue was discovered in pip (all versions) because it installs the version with the highest... CVE-2018-20225 Public exploitFix availableDisputed 7.8 HighMay 8, 2020
• pypa pip, debian linux, fedoraproject fedora +3 more +5 more Improper Authentication in pip CVE-2013-5123 Public exploitFix available 5.9 MediumMay 3, 2015
• pypa pip, oracle solaris +1 more pip lack of randomness in build directory CVE-2014-8991 Fix available 2.1 LowNovember 24, 2014
• pypa pip, fedoraproject fedora +1 more Improper Link Resolution Before File Access in pip CVE-2013-1888 Fix available 2.1 LowAugust 16, 2013
• pypa pip Improper Input Validation in pip CVE-2013-1629 Fix available 6.8 MediumAugust 6, 2013