Pypa Pip vulnerabilities

• pip maintainers pip pip absolute path traversal during download from malicious package indexes CVE-2026-13346 Fix available 5.6 MediumJuly 29, 2026
• pip maintainers pip, red hat exploit intelligence, lightspeed core +34 more +36 more pip can extract console_scripts and gui_scripts outside installation directory CVE-2026-8643 Fix available 4.1 MediumMay 28, 2026
• pip maintainers pip Mercurial configuration injectable in repo revision when installing via pip CVE-2023-5752 Fix available 5.5 MediumOctober 24, 2023
• pypa pipenv, fedoraproject fedora +1 more Pipenv's requirements.txt parsing allows malicious index url in comments CVE-2022-21668 Public exploitFix available 8.0 HighJanuary 10, 2022
• microsoft python-pip, pypa pip, oracle agile product lifecycle management +2 more +4 more Improper Input Validation in pip CVE-2021-3572 Public exploitFix available 5.7 MediumJuly 13, 2021
• pypa pip, debian linux, opensuse leap +2 more +4 more Path Traversal in pip CVE-2019-20916 Fix available 7.5 HighSeptember 4, 2020
• pypa pip An issue was discovered in pip (all versions) because it installs the version with the highest... CVE-2018-20225 Public exploitFix availableDisputed 7.8 HighMay 8, 2020
• pypa pip, debian linux, fedoraproject fedora +3 more +5 more Improper Authentication in pip CVE-2013-5123 Public exploitFix available 5.9 MediumMay 3, 2015
• pypa pip, oracle solaris +1 more pip lack of randomness in build directory CVE-2014-8991 Fix available 2.1 LowNovember 24, 2014
• pypa pip, fedoraproject fedora +1 more Improper Link Resolution Before File Access in pip CVE-2013-1888 Fix available 2.1 LowAugust 16, 2013
• pypa pip Improper Input Validation in pip CVE-2013-1629 Fix available 6.8 MediumAugust 6, 2013