CVE-2026-8643
CVE-2026-8643 · pip can extract console_scripts and gui_scripts outside installation directory
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
CVSS 4.1 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
pip
- Versions
- ≥ 24.0, < 26.1.2: Affected (python)
Update to 26.1.2
python-pip Debian:12
- Versions
- 23.0.1+dfsg-1
- 23.1.2+dfsg-1
- 23.1.2+dfsg-2
- 23.2+dfsg-1
- 23.2.1+dfsg-1
- 23.3+dfsg-1
- 24.0+dfsg-1
- 24.0+dfsg-2
- 24.1+dfsg-1
- 24.1.1+dfsg-1
- 24.2+dfsg-1
- 24.3.1+dfsg-1
- 25.0+dfsg-1
- 25.0.1+dfsg-1
- 25.1+dfsg-1
- 25.1.1+dfsg-1
- 25.2+dfsg-1
- 25.3+dfsg-1
- 26.0+dfsg-1
- 26.0.1+dfsg-1
- 26.1.1+dfsg-1
- 26.1.2+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Debian:13
- Versions
- 25.1.1+dfsg-1
- 25.2+dfsg-1
- 25.3+dfsg-1
- 26.0+dfsg-1
- 26.0.1+dfsg-1
- 26.1.1+dfsg-1
- 26.1.2+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Debian:14
- Versions
- 25.1.1+dfsg-1
- 25.2+dfsg-1
- 25.3+dfsg-1
- 26.0+dfsg-1
- 26.0.1+dfsg-1
- 26.1.1+dfsg-1
- Affected ranges
- ECOSYSTEM: < 26.1.2+dfsg-1
Update to 26.1.2+dfsg-1
pip PyPI
- Versions
- 0.2
- 0.2.1
- 0.3
- 0.3.1
- 0.4
- 0.5
- 0.5.1
- 0.6
- 0.6.1
- 0.6.2
- 0.6.3
- 0.7
- 0.7.1
- 0.7.2
- 0.8
- 0.8.1
- 0.8.2
- 0.8.3
- 1.0
- 1.0.1
- 1.0.2
- 1.1
- 1.2
- 1.2.1
- 1.3
- 1.3.1
- 1.4
- 1.4.1
- 1.5
- 1.5.1
- 1.5.2
- 1.5.3
- 1.5.4
- 1.5.5
- 1.5.6
- 10.0.0
- 10.0.0b1
- 10.0.0b2
- 10.0.1
- 18.0
- 18.1
- 19.0
- 19.0.1
- 19.0.2
- 19.0.3
- 19.1
- 19.1.1
- 19.2
- 19.2.1
- 19.2.2
- 19.2.3
- 19.3
- 19.3.1
- 20.0
- 20.0.1
- 20.0.2
- 20.1
- 20.1.1
- 20.1b1
- 20.2
- 20.2.1
- 20.2.2
- 20.2.3
- 20.2.4
- 20.2b1
- 20.3
- 20.3.1
- 20.3.2
- 20.3.3
- 20.3.4
- 20.3b1
- 21.0
- 21.0.1
- 21.1
- 21.1.1
- 21.1.2
- 21.1.3
- 21.2
- 21.2.1
- 21.2.2
- 21.2.3
- 21.2.4
- 21.3
- 21.3.1
- 22.0
- 22.0.1
- 22.0.2
- 22.0.3
- 22.0.4
- 22.1
- 22.1.1
- 22.1.2
- 22.1b1
- 22.2
- 22.2.1
- 22.2.2
- 22.3
- 22.3.1
- 23.0
- 23.0.1
- 23.1
- 23.1.1
- 23.1.2
- 23.2
- 23.2.1
- 23.3
- 23.3.1
- 23.3.2
- 24.0
- 24.1
- 24.1.1
- 24.1.2
- 24.1b1
- 24.1b2
- 24.2
- 24.3
- 24.3.1
- 25.0
- 25.0.1
- 25.1
- 25.1.1
- 25.2
- 25.3
- 26.0
- 26.0.1
- 26.1
- 26.1.1
- 6.0
- 6.0.1
- 6.0.2
- 6.0.3
- 6.0.4
- 6.0.5
- 6.0.6
- 6.0.7
- 6.0.8
- 6.1.0
- 6.1.1
- 7.0.0
- 7.0.1
- 7.0.2
- 7.0.3
- 7.1.0
- 7.1.1
- 7.1.2
- 8.0.0
- 8.0.1
- 8.0.2
- 8.0.3
- 8.1.0
- 8.1.1
- 8.1.2
- 9.0.0
- 9.0.1
- 9.0.2
- 9.0.3
- Affected ranges
- ECOSYSTEM: < 26.1.2
Update to 26.1.2
python-pip Ubuntu:Pro:14.04:LTS
- Versions
- 1.4.1-2
- 1.5.4-1
- 1.5.4-1ubuntu1
- 1.5.4-1ubuntu3
- 1.5.4-1ubuntu4
- 1.5.4-1ubuntu4+esm1
- 1.5.4-1ubuntu4+esm2
- 1.5.4-1ubuntu4+esm3
- 1.5.4-1ubuntu4+esm4
- 1.5.4-1ubuntu4+esm5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Ubuntu:Pro:16.04:LTS
- Versions
- 1.5.6-7ubuntu1
- 1.5.6-7ubuntu2
- 8.0.2-7
- 8.0.3-1
- 8.0.3-2
- 8.1.0-1
- 8.1.0-2
- 8.1.1-1
- 8.1.1-2
- 8.1.1-2ubuntu0.1
- 8.1.1-2ubuntu0.2
- 8.1.1-2ubuntu0.4
- 8.1.1-2ubuntu0.6
- 8.1.1-2ubuntu0.6+esm2
- 8.1.1-2ubuntu0.6+esm3
- 8.1.1-2ubuntu0.6+esm4
- 8.1.1-2ubuntu0.6+esm5
- 8.1.1-2ubuntu0.6+esm6
- 8.1.1-2ubuntu0.6+esm8
- 8.1.1-2ubuntu0.6+esm10
- 8.1.1-2ubuntu0.6+esm11
- 8.1.1-2ubuntu0.6+esm12
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Ubuntu:Pro:18.04:LTS
- Versions
- 9.0.1-2
- 9.0.1-2.3~ubuntu1
- 9.0.1-2.3~ubuntu1.18.04.1
- 9.0.1-2.3~ubuntu1.18.04.2
- 9.0.1-2.3~ubuntu1.18.04.3
- 9.0.1-2.3~ubuntu1.18.04.4
- 9.0.1-2.3~ubuntu1.18.04.5
- 9.0.1-2.3~ubuntu1.18.04.5+esm2
- 9.0.1-2.3~ubuntu1.18.04.5+esm3
- 9.0.1-2.3~ubuntu1.18.04.6
- 9.0.1-2.3~ubuntu1.18.04.6+esm1
- 9.0.1-2.3~ubuntu1.18.04.7
- 9.0.1-2.3~ubuntu1.18.04.7+esm1
- 9.0.1-2.3~ubuntu1.18.04.8
- 9.0.1-2.3~ubuntu1.18.04.8+esm1
- 9.0.1-2.3~ubuntu1.18.04.8+esm2
- 9.0.1-2.3~ubuntu1.18.04.8+esm4
- 9.0.1-2.3~ubuntu1.18.04.8+esm6
- 9.0.1-2.3~ubuntu1.18.04.8+esm7
- 9.0.1-2.3~ubuntu1.18.04.8+esm8
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Ubuntu:Pro:20.04:LTS
- Versions
- 18.1-5
- 18.1-5build1
- 18.1-5ubuntu1
- 20.0.2-2
- 20.0.2-4
- 20.0.2-5
- 20.0.2-5ubuntu1
- 20.0.2-5ubuntu1.1
- 20.0.2-5ubuntu1.3
- 20.0.2-5ubuntu1.4
- 20.0.2-5ubuntu1.5
- 20.0.2-5ubuntu1.6
- 20.0.2-5ubuntu1.7
- 20.0.2-5ubuntu1.8
- 20.0.2-5ubuntu1.9
- 20.0.2-5ubuntu1.10
- 20.0.2-5ubuntu1.10+esm2
- 20.0.2-5ubuntu1.11
- 20.0.2-5ubuntu1.11+esm2
- 20.0.2-5ubuntu1.11+esm3
- 20.0.2-5ubuntu1.11+esm4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Ubuntu:Pro:22.04:LTS
- Versions
- 20.3.4-4
- 21.3.1+dfsg-3
- 22.0.2+dfsg-1
- 22.0.2+dfsg-1ubuntu0.1
- 22.0.2+dfsg-1ubuntu0.2
- 22.0.2+dfsg-1ubuntu0.3
- 22.0.2+dfsg-1ubuntu0.4
- 22.0.2+dfsg-1ubuntu0.5
- 22.0.2+dfsg-1ubuntu0.6
- 22.0.2+dfsg-1ubuntu0.7
- 22.0.2+dfsg-1ubuntu0.7+esm1
- 22.0.2+dfsg-1ubuntu0.7+esm2
- 22.0.2+dfsg-1ubuntu0.7+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Ubuntu:Pro:24.04:LTS
- Versions
- 23.2+dfsg-1
- 23.3+dfsg-1
- 24.0+dfsg-1
- 24.0+dfsg-1ubuntu1
- 24.0+dfsg-1ubuntu1.1
- 24.0+dfsg-1ubuntu1.2
- 24.0+dfsg-1ubuntu1.3
- 24.0+dfsg-1ubuntu1.3+esm1
- 24.0+dfsg-1ubuntu1.3+esm2
- 24.0+dfsg-1ubuntu1.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Ubuntu:25.10
- Versions
- 25.0+dfsg-1
- 25.1.1+dfsg-1
- 25.1.1+dfsg-1ubuntu1
- 25.1.1+dfsg-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Ubuntu:26.10
- Versions
- 25.1.1+dfsg-1ubuntu2
- 26.1.2+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-pip Ubuntu:Pro:26.04:LTS
- Versions
- 25.1.1+dfsg-1ubuntu2
- 25.1.1+dfsg-1ubuntu2+esm1
- 25.1.1+dfsg-1ubuntu2+esm2
- 25.1.1+dfsg-1ubuntu2+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/pypa/pip/pull/14000
- https://mail.python.org/archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/
- http://www.openwall.com/lists/oss-security/2026/06/01/5
- https://access.redhat.com/security/cve/CVE-2026-8643
- https://bugzilla.redhat.com/show_bug.cgi?id=2460927
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:42079
- https://access.redhat.com/errata/RHSA-2026:36193
- https://access.redhat.com/errata/RHSA-2026:36315
- https://access.redhat.com/errata/RHSA-2026:42144
- https://access.redhat.com/errata/RHSA-2026:50479
- https://access.redhat.com/errata/RHSA-2026:34374
- https://access.redhat.com/errata/RHSA-2026:42132
- https://access.redhat.com/errata/RHSA-2026:54760
- https://access.redhat.com/errata/RHSA-2026:33313
- https://access.redhat.com/errata/RHSA-2026:34891
- https://access.redhat.com/errata/RHSA-2026:56347
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:34772
- https://access.redhat.com/errata/RHSA-2026:34778
- https://access.redhat.com/errata/RHSA-2026:34780
- https://access.redhat.com/errata/RHSA-2026:34773
- https://nvd.nist.gov/vuln/detail/CVE-2026-8643