CVE-2026-8643
pip can extract console_scripts and gui_scripts outside installation directory
CVSS Score
8.0
EPSS Score
0.3%
EPSS Percentile
24th
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
| Vendor | python packaging authority |
| Product | pip |
| Published | Jun 1, 2026 |
| Last Updated | Jul 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for python packaging authority pip
Be the first to know when new high vulnerabilities affecting python packaging authority pip are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Packaging Authority / pip
24.0 < 26.1.2
References
github.com: https://github.com/pypa/pip/pull/14000 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/ openwall.com: http://www.openwall.com/lists/oss-security/2026/06/01/5 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-8643 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2460927 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42078 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42079 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36193 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36315 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42144 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34374 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42132 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33313 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34891 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42644 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34772 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34778 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34780 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34773 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34774 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34739 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34752 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34765 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34758 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34756 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34760 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34776 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34748 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34775 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34740 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34749 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34750 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34741 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34777 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37275 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34456 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37283
Credits
🔍 Lumír Balhar Damian Shaw (https://github.com/notatallshaw) Gregory P. Smith (https://github.com/gpshead) Jannis Leidel (https://github.com/jezdez) Pradyun Gedam (https://github.com/pradyunsg) Paul Moore (https://github.com/pfmoore)