Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pip

13 known vulnerabilities (6 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
13 · 6 medium, 1 low
Registry
PyPI

Advisories 13

  • CVE-2026-13346Medium 5.6

    pip absolute path traversal during download from malicious package indexes

    Affected: fixed in 26.2; fixed in 26.2.0.

  • CVE-2026-8643Medium 4.1

    pip can extract console_scripts and gui_scripts outside installation directory

    Affected: from 24.0, fixed in 26.1.2; fixed in 26.1.2.

  • CVE-2026-6357Medium 5.3

    pip self-update functionality can import newly installed modules after wheel installation

    Affected: fixed in 26.1; fixed in 26.1.

  • CVE-2026-3219Medium 4.6

    pip doesn't reject concatenated ZIP and tar archives

    Affected: fixed in 26.1; fixed in 26.1.

  • Limited path traversal when installing wheel archives

    Affected: fixed in 26.0; fixed in 26.0.

  • CVE-2025-8869Medium 5.9

    Fallback tar extraction in pip doesn't check symbolic links point to extraction directory

    Affected: fixed in 25.3; fixed in 25.3.

  • CVE-2023-5752Medium 5.5

    Mercurial configuration injectable in repo revision when installing via pip

    Affected: version range not reported; fixed in 23.3.

  • A flaw was found in python-pip in the way it handled Unicode separators in git references.

    Affected: fixed in 21.1.

  • The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition…

    Affected: fixed in 19.2; fixed in 19.2.

  • The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows…

    Affected: fixed in 1.5.

  • pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build…

    Affected: from 1.3, fixed in 6.0.

  • pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.

    Affected: fixed in 1.3.

  • pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which…

    Affected: fixed in 1.3.