GHSA-wf93-45jw-7689
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
At a glance
- Published
- Updated
- CVE
- CVE-2026-8643
- Aliases
- PYSEC-2026-196
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Affected packages
| Package | Versions |
|---|---|
| PyPI · pip | introduced 0, fixed 26.1.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-8643 ADVISORY
- https://github.com/pypa/pip/pull/14000 WEB
- https://access.redhat.com/errata/RHSA-2026:33313 WEB
- https://access.redhat.com/errata/RHSA-2026:34776 WEB
- https://access.redhat.com/errata/RHSA-2026:34777 WEB
- https://access.redhat.com/errata/RHSA-2026:34778 WEB
- https://access.redhat.com/errata/RHSA-2026:34780 WEB
- https://access.redhat.com/errata/RHSA-2026:34891 WEB
- https://access.redhat.com/errata/RHSA-2026:36193 WEB
- https://access.redhat.com/errata/RHSA-2026:36315 WEB
- https://access.redhat.com/errata/RHSA-2026:37275 WEB
- https://access.redhat.com/errata/RHSA-2026:37283 WEB
- https://access.redhat.com/security/cve/CVE-2026-8643 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2460927 WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml WEB
- https://github.com/pypa/pip PACKAGE
- https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json WEB
- https://access.redhat.com/errata/RHSA-2026:34374 WEB
- https://access.redhat.com/errata/RHSA-2026:34456 WEB
- https://access.redhat.com/errata/RHSA-2026:34739 WEB
- https://access.redhat.com/errata/RHSA-2026:34740 WEB
- https://access.redhat.com/errata/RHSA-2026:34741 WEB
- https://access.redhat.com/errata/RHSA-2026:34748 WEB
- https://access.redhat.com/errata/RHSA-2026:34749 WEB
- https://access.redhat.com/errata/RHSA-2026:34750 WEB
- https://access.redhat.com/errata/RHSA-2026:34752 WEB
- https://access.redhat.com/errata/RHSA-2026:34756 WEB
- https://access.redhat.com/errata/RHSA-2026:34758 WEB
- https://access.redhat.com/errata/RHSA-2026:34760 WEB
- https://access.redhat.com/errata/RHSA-2026:34765 WEB
- https://access.redhat.com/errata/RHSA-2026:34772 WEB
- https://access.redhat.com/errata/RHSA-2026:34773 WEB
- https://access.redhat.com/errata/RHSA-2026:34774 WEB
- https://access.redhat.com/errata/RHSA-2026:34775 WEB
- http://www.openwall.com/lists/oss-security/2026/06/01/5 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |