CLEANSTART-2026-OH23140 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed o...

🗓️ 18 Sep 2026 01:43:00Reported by GoogleType

osv🔗 osv.dev👁 8 Views

python3 pip installs entry points outside installation directory via unsanitized script paths.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java, Node.js and IBM WebSphere Application Server Liberty	15 Apr 202502:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rapid Infrastructure Automation	28 May 202514:39	–	ibm
IBM Security Bulletins	Security Bulletin: AIX/VIOS is affected by multiple vulnerabilities due to Python	19 Nov 202515:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a path traversal in Python [CVE-2025-4517]	17 Dec 202514:16	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in the Linux Kernel, Samba, Sudo, Python, and tcmu-runner affect IBM Spectrum Protect Plus	6 May 202202:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with Python affect IBM Cloud Object Storage Systems (Sept2023v2)	25 Sep 202322:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Certifi, Setuptools and Python may affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore (CVE-2022-23491, CVE-2022-40897, CVE-2022-45061)	1 Feb 202310:43	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to regular expression DoS and command injection due to the python package (CVE-2024-6232, CVE-2024-9287)	23 Jul 202516:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities	19 Jun 202517:12	–	ibm

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OH23140.json
osv	www.osv.dev/vulnerability/CVE-2015-20107
osv	www.osv.dev/vulnerability/CVE-2015-2104
osv	www.osv.dev/vulnerability/CVE-2019-16056
osv	www.osv.dev/vulnerability/CVE-2019-16935
osv	www.osv.dev/vulnerability/CVE-2019-20907
osv	www.osv.dev/vulnerability/CVE-2019-5010
osv	www.osv.dev/vulnerability/CVE-2020-14422
osv	www.osv.dev/vulnerability/CVE-2020-8315
osv	www.osv.dev/vulnerability/CVE-2020-8492

18 Sep 2026 12:15Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.19.8

EPSS0.40736

python3 pip console_scripts gui_scripts path traversal entry point