Read the docs
TI-2018-14332 Aliases CVE-2018-20225GHSA-7p5p-7qq5-cc86

An issue was discovered in pip (all versions) because it installs the version with the…

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0178 78th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*all versionsVulnerablepypa
  • cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·pypa

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20225
  2. 2026-10-03 Alias added: GHSA-7p5p-7qq5-cc86

References

Advisory 2

Other 2

  • TI-2013-01432 pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not… CVSS 2.0MEDIUM 6.8
  • TI-2019-15130 The pip package before 19.2 for Python allows Directory Traversal when a URL is given in… CVSS 3.1HIGH 7.5
  • TI-2013-04447 The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS… CVSS 3.1MEDIUM 5.9
  • TI-2021-02521 Improper input validation in python-pip CVSS 3.1MEDIUM 5.7
  • TI-2026-11308 pip absolute path traversal during download from malicious package indexes CVSS 4.0MEDIUM 5.6
  • TI-2023-05291 Mercurial configuration injectable in repo revision when installing via pip CVSS 3.1MEDIUM 5.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences