Fallback tar extraction in pip doesn't check symbolic links point to extraction directory
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 20 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Packaging Authority | pip | before 25.3 | 25.3 | Patch available | CNA |
| — | pip (PyPI) | before 25.3 | 25.3 | Patch available | GHSA-4xh5-x5gv-qwph |
- pip VendorPython Packaging Authority Affected before 25.3 Fixed in 25.3 Patch available CNA
- pip (PyPI) Vendor— Affected before 25.3 Fixed in 25.3 Patch available GHSA-4xh5-x5gv-qwph
Remediation
- Fix · CNA pip (Python Packaging Authority) Fixed in 25.3
- Fix · GHSA-4xh5-x5gv-qwph pip (PyPI) Fixed in 25.3 Advisory →
Red Hat 5 advisories
- RHSA-2026:94476 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Base Images 3.0.8 (CUDA)
- Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
- RHSA-2026:94459 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Base Images 3.0.8 (CPU)
- Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
- RHSA-2026:91236 Released 2026-10-27 · Red Hat rating CriticalRed Hat AI Base Images 3.0.7 (CUDA)
- Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
Show 2 more Red Hat advisories
- RHSA-2026:91232 Released 2026-10-27 · Red Hat rating CriticalRed Hat AI Base Images 3.0.7 (CPU)
- Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
- RHSA-2026:91219 Released 2026-10-27 · Red Hat rating CriticalRed Hat AI Base Images 3.0.7 (ROCm)
- Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform Ansible Core 2 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Service Telemetry Framework 1.5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI 3.0 | Fixed | RHSA-2026:91219, RHSA-2026:91232, RHSA-2026:91236, RHSA-2026:94459, RHSA-2026:94476 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8869
- 2026-10-03 Alias added: GHSA-4xh5-x5gv-qwph
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91219 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91232 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91236 · Red Hat
- 2026-10-30 Fix available: Red Hat OpenShift AI 3.0 · Red Hat
- 2026-11-03 Fix available: RHSA-2026:94459 · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94476 · Red Hat
- 2026-11-04 Affected versions changed · Red Hat
References
Advisory 2
Other 5
- https://github.com/pypa/pip/commit/f2b92314da012b9fffa36b3f3e67748a37ef464a
- https://github.com/pypa/pip
- https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html
- https://mail.python.org/archives/list/[email protected]/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN
- https://pip.pypa.io/en/stable/news/#v25-2
More Python Packaging Authority vulnerabilities
- TI-2026-02782 pip doesn't reject concatenated ZIP and tar archives CVSS 4.0MEDIUM 4.6
- TI-2026-01386 Limited path traversal when installing wheel archives CVSS 4.0LOW 2.0
Sources
- CVE-2025-8869 · CVE Program
- CVE-2025-8869 · NVD
- FIRST EPSS
- GHSA-4xh5-x5gv-qwph · GitHub Advisory Database · CC BY 4.0
- CVE-2025-8869 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences