CVE-2026-8643

5.5 MEDIUM

Published: June 01, 2026 Modified: June 04, 2026

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/pypa/pip/pull/14000

Source: cna@python.org

Issue Tracking Patch

https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/

Source: cna@python.org

Mailing List Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/06/01/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

3 reference(s) from NVD

Quick Stats

CVSS v3 Score

5.5 / 10.0

EPSS (Exploit Probability)

0.2%

6th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-22

Affected Vendors

pypa

Related CVEs