TI-2026-02782 CVE-2026-3219 · GHSA-58qw-9mgm-455v
pip doesn't reject concatenated ZIP and tar archives
Priority LOW 20
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file.
RHSA-2026:36359
Red Hat Hardened Images RPMs Security Update
Released 2026-07-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images python-pip-26.1.2-1.hum1@src, python-pip-wheel-26.1.2-1.hum1@noarch@public-hummingbird-aarch64-rpms, python-pip-wheel-26.1.2-1.hum1@noarch@public-hummingbird-x86_64-rpms +2
Fixes 2 records
TI-2026-07594 CVE-2026-8643 · GHSA-wf93-45jw-7689
pip can extract console_scripts and gui_scripts outside installation directory
Priority LOW 19
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…