p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de pip

Vulnérabilités publiées pour pip au cours des 30 derniers jours : 0. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 13

  1. CVE-2026-13346

    Moyenne · CVSS 5.6EPSS 0,29%Correctif disponible

    pip absolute path traversal during download from malicious package indexes

    pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

    pip pipPython
    • Mettez à jour vers 26.2
    • Mettez à jour vers 26.2.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-8643

    Moyenne · CVSS 4.1EPSS 0,47%Correctif disponible

    pip can extract console_scripts and gui_scripts outside installation directory

    pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

    pipPython
    • Mettez à jour vers 26.1.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-6357

    Moyenne · CVSS 5.3EPSS 0,17%Correctif disponible

    pip self-update functionality can import newly installed modules after wheel installation

    pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

    pipPython
    • Mettez à jour vers 26.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-3219

    Moyenne · CVSS 4.6EPSS 0,14%Correctif disponible

    pip doesn't reject concatenated ZIP and tar archives

    pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

    pipPython
    • Mettez à jour vers 26.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2026-1703

    Faible · CVSS 2EPSS 0,44%Correctif disponible

    Limited path traversal when installing wheel archives

    When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

    pipPython
    • Mettez à jour vers 26.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2025-8869

    Moyenne · CVSS 5.9EPSS 0,47%Correctif disponible

    Fallback tar extraction in pip doesn't check symbolic links point to extraction directory

    When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback co

    pipPython
    • Mettez à jour vers 25.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2023-5752

    Moyenne · CVSS 5.5EPSS 0,5%Correctif disponible

    Mercurial configuration injectable in repo revision when installing via pip

    When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

    pipPython
    • Mettez à jour vers 23.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2021-3572

    Moyenne · CVSS 5.7EPSS 1,83%Correctif disponible

    CVE-2021-3572

    A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

    pipPython
    • Mettez à jour vers 21.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2019-20916

    Élevée · CVSS 7.5EPSS 3%Correctif disponible

    CVE-2019-20916

    The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

    pip pipPython
    • Mettez à jour vers 19.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2013-5123

    Moyenne · CVSS 5.9EPSS 7,99%Code d’exploitation publicCorrectif disponible

    CVE-2013-5123

    The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.

    pipPython
    • Mettez à jour vers 1.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2013-1629

    Élevée · CVSS 8.4EPSS 6,19%Correctif disponible

    CVE-2013-1629

    pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

    pipPython
    • Mettez à jour vers 1.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →