Python Packaging Authority
Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Python Packaging Authority records in CISA KEVNo Python Packaging Authority vulnerabilities are listed in CISA KEV.
Priority LOW 27
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.
CVSS 4.0MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.00493 · Published 2025-09-24 · Partial fix · 25.3 CWE-59
Priority LOW 20
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file.
CVSS 4.0MEDIUM 4.6· Local · No auth · User interaction · EPSS 0.00144 · Published 2026-04-20 · Partial fix · 26.1 CWE-434
Priority LOW 11
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory.
CVSS 4.0LOW 2.0· Network · Low privileges · User interaction · EPSS 0.00436 · Published 2026-02-02 · Partial fix · 26.0 CWE-22
