p PatchFirst

CVE-2026-6357

CVE-2026-6357 · pip self-update functionality can import newly installed modules after wheel installation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pip

    Versions
    • ≥ 0, < 26.1: Affected (python)

    Update to 26.1

  • python-pip Debian:12

    Versions
    • 23.0.1+dfsg-1
    • 23.1.2+dfsg-1
    • 23.1.2+dfsg-2
    • 23.2+dfsg-1
    • 23.2.1+dfsg-1
    • 23.3+dfsg-1
    • 24.0+dfsg-1
    • 24.0+dfsg-2
    • 24.1+dfsg-1
    • 24.1.1+dfsg-1
    • 24.2+dfsg-1
    • 24.3.1+dfsg-1
    • 25.0+dfsg-1
    • 25.0.1+dfsg-1
    • 25.1+dfsg-1
    • 25.1.1+dfsg-1
    • 25.2+dfsg-1
    • 25.3+dfsg-1
    • 26.0+dfsg-1
    • 26.0.1+dfsg-1
    • 26.1.1+dfsg-1
    • 26.1.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Debian:13

    Versions
    • 25.1.1+dfsg-1
    • 25.2+dfsg-1
    • 25.3+dfsg-1
    • 26.0+dfsg-1
    • 26.0.1+dfsg-1
    • 26.1.1+dfsg-1
    • 26.1.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Debian:14

    Versions
    • 25.1.1+dfsg-1
    • 25.2+dfsg-1
    • 25.3+dfsg-1
    • 26.0+dfsg-1
    • 26.0.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 26.1.1+dfsg-1

    Update to 26.1.1+dfsg-1

  • pip PyPI

    Versions
    • 0.2
    • 0.2.1
    • 0.3
    • 0.3.1
    • 0.4
    • 0.5
    • 0.5.1
    • 0.6
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.7
    • 0.7.1
    • 0.7.2
    • 0.8
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.2
    • 1.2.1
    • 1.3
    • 1.3.1
    • 1.4
    • 1.4.1
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • 1.5.5
    • 1.5.6
    • 10.0.0
    • 10.0.0b1
    • 10.0.0b2
    • 10.0.1
    • 18.0
    • 18.1
    • 19.0
    • 19.0.1
    • 19.0.2
    • 19.0.3
    • 19.1
    • 19.1.1
    • 19.2
    • 19.2.1
    • 19.2.2
    • 19.2.3
    • 19.3
    • 19.3.1
    • 20.0
    • 20.0.1
    • 20.0.2
    • 20.1
    • 20.1.1
    • 20.1b1
    • 20.2
    • 20.2.1
    • 20.2.2
    • 20.2.3
    • 20.2.4
    • 20.2b1
    • 20.3
    • 20.3.1
    • 20.3.2
    • 20.3.3
    • 20.3.4
    • 20.3b1
    • 21.0
    • 21.0.1
    • 21.1
    • 21.1.1
    • 21.1.2
    • 21.1.3
    • 21.2
    • 21.2.1
    • 21.2.2
    • 21.2.3
    • 21.2.4
    • 21.3
    • 21.3.1
    • 22.0
    • 22.0.1
    • 22.0.2
    • 22.0.3
    • 22.0.4
    • 22.1
    • 22.1.1
    • 22.1.2
    • 22.1b1
    • 22.2
    • 22.2.1
    • 22.2.2
    • 22.3
    • 22.3.1
    • 23.0
    • 23.0.1
    • 23.1
    • 23.1.1
    • 23.1.2
    • 23.2
    • 23.2.1
    • 23.3
    • 23.3.1
    • 23.3.2
    • 24.0
    • 24.1
    • 24.1.1
    • 24.1.2
    • 24.1b1
    • 24.1b2
    • 24.2
    • 24.3
    • 24.3.1
    • 25.0
    • 25.0.1
    • 25.1
    • 25.1.1
    • 25.2
    • 25.3
    • 26.0
    • 26.0.1
    • 6.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    • 6.0.7
    • 6.0.8
    • 6.1.0
    • 6.1.1
    • 7.0.0
    • 7.0.1
    • 7.0.2
    • 7.0.3
    • 7.1.0
    • 7.1.1
    • 7.1.2
    • 8.0.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.1.0
    • 8.1.1
    • 8.1.2
    • 9.0.0
    • 9.0.1
    • 9.0.2
    • 9.0.3
    Affected ranges
    • ECOSYSTEM: < 26.1

    Update to 26.1

  • python-pip Ubuntu:Pro:14.04:LTS

    Versions
    • 1.4.1-2
    • 1.5.4-1
    • 1.5.4-1ubuntu1
    • 1.5.4-1ubuntu3
    • 1.5.4-1ubuntu4
    • 1.5.4-1ubuntu4+esm1
    • 1.5.4-1ubuntu4+esm2
    • 1.5.4-1ubuntu4+esm3
    • 1.5.4-1ubuntu4+esm4
    • 1.5.4-1ubuntu4+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:16.04:LTS

    Versions
    • 1.5.6-7ubuntu1
    • 1.5.6-7ubuntu2
    • 8.0.2-7
    • 8.0.3-1
    • 8.0.3-2
    • 8.1.0-1
    • 8.1.0-2
    • 8.1.1-1
    • 8.1.1-2
    • 8.1.1-2ubuntu0.1
    • 8.1.1-2ubuntu0.2
    • 8.1.1-2ubuntu0.4
    • 8.1.1-2ubuntu0.6
    • 8.1.1-2ubuntu0.6+esm2
    • 8.1.1-2ubuntu0.6+esm3
    • 8.1.1-2ubuntu0.6+esm4
    • 8.1.1-2ubuntu0.6+esm5
    • 8.1.1-2ubuntu0.6+esm6
    • 8.1.1-2ubuntu0.6+esm8
    • 8.1.1-2ubuntu0.6+esm10
    • 8.1.1-2ubuntu0.6+esm11
    • 8.1.1-2ubuntu0.6+esm12
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.1-2
    • 9.0.1-2.3~ubuntu1
    • 9.0.1-2.3~ubuntu1.18.04.1
    • 9.0.1-2.3~ubuntu1.18.04.2
    • 9.0.1-2.3~ubuntu1.18.04.3
    • 9.0.1-2.3~ubuntu1.18.04.4
    • 9.0.1-2.3~ubuntu1.18.04.5
    • 9.0.1-2.3~ubuntu1.18.04.5+esm2
    • 9.0.1-2.3~ubuntu1.18.04.5+esm3
    • 9.0.1-2.3~ubuntu1.18.04.6
    • 9.0.1-2.3~ubuntu1.18.04.6+esm1
    • 9.0.1-2.3~ubuntu1.18.04.7
    • 9.0.1-2.3~ubuntu1.18.04.7+esm1
    • 9.0.1-2.3~ubuntu1.18.04.8
    • 9.0.1-2.3~ubuntu1.18.04.8+esm1
    • 9.0.1-2.3~ubuntu1.18.04.8+esm2
    • 9.0.1-2.3~ubuntu1.18.04.8+esm4
    • 9.0.1-2.3~ubuntu1.18.04.8+esm6
    • 9.0.1-2.3~ubuntu1.18.04.8+esm7
    • 9.0.1-2.3~ubuntu1.18.04.8+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:20.04:LTS

    Versions
    • 18.1-5
    • 18.1-5build1
    • 18.1-5ubuntu1
    • 20.0.2-2
    • 20.0.2-4
    • 20.0.2-5
    • 20.0.2-5ubuntu1
    • 20.0.2-5ubuntu1.1
    • 20.0.2-5ubuntu1.3
    • 20.0.2-5ubuntu1.4
    • 20.0.2-5ubuntu1.5
    • 20.0.2-5ubuntu1.6
    • 20.0.2-5ubuntu1.7
    • 20.0.2-5ubuntu1.8
    • 20.0.2-5ubuntu1.9
    • 20.0.2-5ubuntu1.10
    • 20.0.2-5ubuntu1.10+esm2
    • 20.0.2-5ubuntu1.11
    • 20.0.2-5ubuntu1.11+esm2
    • 20.0.2-5ubuntu1.11+esm3
    • 20.0.2-5ubuntu1.11+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:22.04:LTS

    Versions
    • 20.3.4-4
    • 21.3.1+dfsg-3
    • 22.0.2+dfsg-1
    • 22.0.2+dfsg-1ubuntu0.1
    • 22.0.2+dfsg-1ubuntu0.2
    • 22.0.2+dfsg-1ubuntu0.3
    • 22.0.2+dfsg-1ubuntu0.4
    • 22.0.2+dfsg-1ubuntu0.5
    • 22.0.2+dfsg-1ubuntu0.6
    • 22.0.2+dfsg-1ubuntu0.7
    • 22.0.2+dfsg-1ubuntu0.7+esm1
    • 22.0.2+dfsg-1ubuntu0.7+esm2
    • 22.0.2+dfsg-1ubuntu0.7+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:24.04:LTS

    Versions
    • 23.2+dfsg-1
    • 23.3+dfsg-1
    • 24.0+dfsg-1
    • 24.0+dfsg-1ubuntu1
    • 24.0+dfsg-1ubuntu1.1
    • 24.0+dfsg-1ubuntu1.2
    • 24.0+dfsg-1ubuntu1.3
    • 24.0+dfsg-1ubuntu1.3+esm1
    • 24.0+dfsg-1ubuntu1.3+esm2
    • 24.0+dfsg-1ubuntu1.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:25.10

    Versions
    • 25.0+dfsg-1
    • 25.1.1+dfsg-1
    • 25.1.1+dfsg-1ubuntu1
    • 25.1.1+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:26.10

    Versions
    • 25.1.1+dfsg-1ubuntu2
    • 26.1.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:26.04:LTS

    Versions
    • 25.1.1+dfsg-1ubuntu2
    • 25.1.1+dfsg-1ubuntu2+esm1
    • 25.1.1+dfsg-1ubuntu2+esm2
    • 25.1.1+dfsg-1ubuntu2+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →