Read the docs
TI-2026-07594 Aliases CVE-2026-8643GHSA-wf93-45jw-7689

pip can extract console_scripts and gui_scripts outside installation directory

Priority LOW 19CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 18 fixed, 14 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Fix Partial pip (Python Packaging Authority): 26.1.2pip (PyPI): 26.1.2Red Hat: 51 advisoriesRed Hat: 18 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Python Packaging Authoritypip24.0 to before 26.1.226.1.2Patch availableCNA
—pip (PyPI)before 26.1.226.1.2Patch availableGHSA-wf93-45jw-7689
  • pip VendorPython Packaging Authority Affected 24.0 to before 26.1.2 Fixed in 26.1.2 Patch available CNA
  • pip (PyPI) Vendor— Affected before 26.1.2 Fixed in 26.1.2 Patch available GHSA-wf93-45jw-7689

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*before 26.1.2Vulnerablepypa
  • cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:* Versions before 26.1.2 Vulnerable ·pypa

Remediation

  • Fix · CNA pip (Python Packaging Authority) Fixed in 26.1.2
  • Fix · GHSA-wf93-45jw-7689 pip (PyPI) Fixed in 26.1.2 Advisory →

Red Hat 51 advisories

  • RHSA-2026:91236 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.7 (CUDA)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:91232 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.7 (CPU)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:91219 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.7 (ROCm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
Show 48 more Red Hat advisories
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:74688 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:74685 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:74683 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:74681 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74679 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74677 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:60367 Released 2026-08-26 · Red Hat rating Critical
    RHOAI 3.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9, registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9
  • RHSA-2026:56347 Released 2026-08-18 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-analyzer-addon-rhel9, registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-discovery-addon-rhel9 +4
  • RHSA-2026:54760 Released 2026-08-13 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:50479 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:42644 Released 2026-07-21 · Red Hat rating Important
    RHOAI 2.25.9 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
  • RHSA-2026:42144 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
  • RHSA-2026:42132 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:42079 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 ansible-core-2:2.16.19-1.el10ap, receptor-1.6.6-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, automation-controller-venv-tower-4.7.14-3.el9ap, automation-gateway-proxy-2.6.17-1.el9ap +5
  • RHSA-2026:42078 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
  • RHSA-2026:37283 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4 - GA Release of Model Transparency 1.0.2
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:37275 Released 2026-07-09 · Red Hat rating Critical
    RHOAI 3.3.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
  • RHSA-2026:36359 Released 2026-07-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python-pip-26.1.2-1.hum1@src, python-pip-wheel-26.1.2-1.hum1@noarch@public-hummingbird-aarch64-rpms, python-pip-wheel-26.1.2-1.hum1@noarch@public-hummingbird-x86_64-rpms +2
  • RHSA-2026:36315 Released 2026-07-07 · Red Hat rating Important
    python3.14-pip security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.14-pip-25.2-3.el9_8.5, python3.14-pip-wheel-25.2-3.el9_8.5
  • RHSA-2026:36193 Released 2026-07-07 · Red Hat rating Important
    python3.14-pip security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3.14-pip-25.2-3.el10_2.5, python3.14-pip-wheel-25.2-3.el10_2.5
  • RHSA-2026:34891 Released 2026-07-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python-pip-26.1.1-3.1.hum1@src, python-pip-wheel-26.1.1-3.1.hum1@noarch@public-hummingbird-aarch64-rpms, python-pip-wheel-26.1.1-3.1.hum1@noarch@public-hummingbird-x86_64-rpms +2
  • RHSA-2026:34780 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.0.2 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:34778 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.0.2 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:34777 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.3.2 (TPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:34775 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.3.2 (CUDA 13.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:34776 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.3.2 (CPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:34774 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.0.2 (tpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:34773 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.0.2 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:34772 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.0.2 (cpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:34765 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.2.2 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:34756 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.2.2 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:34758 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.2.2 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:34760 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.2.2 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:34752 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.2.2 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:34750 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.3.2 (ROCm 7.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-7.0-rhel9
  • RHSA-2026:34749 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.3.2 (ROCm 6.4)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:34748 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.3.2 (CUDA 12.9)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:34741 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.3.2 (Spyre)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:34740 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.3.2 (Neuron)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:34739 Released 2026-07-02 · Red Hat rating Important
    Red Hat AI Base Images 3.2.2 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:34456 Released 2026-07-01 · Red Hat rating Critical
    RHOAI 3.4.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9, registry.redhat.io/rhoai/odh-llama-stack-core-rhel9, registry.redhat.io/rhoai/odh-mlserver-rhel9 +33
  • RHSA-2026:34374 Released 2026-07-01 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
  • RHSA-2026:33313 Released 2026-06-29 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Enterprise Linux command line assistantAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:42144
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:34374, RHSA-2026:42132, RHSA-2026:50479
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:42079
Red Hat Discovery 2Fixed RHSA-2026:33313, RHSA-2026:54760
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:36193
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:36315
Red Hat Hardened ImagesFixed RHSA-2026:34891, RHSA-2026:36359
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:56347
Red Hat OpenShift AI 2.25Fixed RHSA-2026:42644, RHSA-2026:87410
Red Hat OpenShift AI 3.0Fixed RHSA-2026:34772, RHSA-2026:34773, RHSA-2026:34774, RHSA-2026:34778, RHSA-2026:34780, RHSA-2026:91219, RHSA-2026:91232, RHSA-2026:91236
Red Hat OpenShift AI 3.2Fixed RHSA-2026:34739, RHSA-2026:34752, RHSA-2026:34756, RHSA-2026:34758, RHSA-2026:34760, RHSA-2026:34765
Red Hat OpenShift AI 3.3Fixed RHSA-2026:34740, RHSA-2026:34741, RHSA-2026:34748, RHSA-2026:34749, RHSA-2026:34750, RHSA-2026:34775, RHSA-2026:34776, RHSA-2026:34777, RHSA-2026:37275
Red Hat OpenShift AI 3.4Fixed RHSA-2026:34456, RHSA-2026:60520, RHSA-2026:74674, RHSA-2026:74677, RHSA-2026:74679, RHSA-2026:74681, RHSA-2026:74683, RHSA-2026:74685, RHSA-2026:74688, RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:60367
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:37283
Not affected: 26 products
  • OpenShift Lightspeed
  • OpenShift Service Mesh 3
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8643
  2. 2026-10-03 Alias added: GHSA-wf93-45jw-7689
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Affected versions changed · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  6. 2026-10-23 Affected versions changed · Red Hat
  7. 2026-10-27 Affected versions changed · Red Hat
  8. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:91219 · Red Hat
  10. 2026-10-30 Fix available: RHSA-2026:91232 · Red Hat
  11. 2026-10-30 Fix available: RHSA-2026:91236 · Red Hat
  12. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  13. 2026-10-30 Affected versions changed · Red Hat
  14. 2026-10-30 Affected versions changed · Red Hat
  15. 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat

References

Patch 1

Advisory 3

Other 33

  • TI-2025-08119 Fallback tar extraction in pip doesn't check symbolic links point to extraction directory CVSS 4.0MEDIUM 5.9
  • TI-2026-02782 pip doesn't reject concatenated ZIP and tar archives CVSS 4.0MEDIUM 4.6
  • TI-2026-01386 Limited path traversal when installing wheel archives CVSS 4.0LOW 2.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences