CLEANSTART-2026-HZ86045 Security fixes for CVE-2026-44431, CVE-2026-44432, CVE-2026-6357, ghsa-jp4c-xjxw-mgf9, ghsa-mf9v-mfxr-j63j, ghsa-qccp-gfcp-xxvc applied in versions: 26.1.1.0-r0

Multiple security vulnerabilities affect the miniforge3 package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: python-pip

Issue Overview: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update...

CVE-2026-6357 vulnerabilities

Vulnerabilities for packages: py3.14-virtualenv, pypy-3.10, py3-pip, datadog-agent, py3-virtualenv, py3-cassandra-medusa, kubeflow-katib...

Linux Distros Unpatched Vulnerability : CVE-2026-6357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These...

CVE-2026-6357

creationtimestamp| type| source ---|---|--- 2026-04-27 20:57:33+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkixil2wqr2j 2026-05-07 12:00:58+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mlb66cgbnt23...

aihandler (>=1.9.8, <=1.19.0), aiorobonect (>=0.2.3, <=0.2.5) +18 more potentially affected by CVE-2026-6357 via pip (23.1.2)

pip PYPI version 23.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aihandler =1.9.8, =0.2.3, =1.10.0, =2023.5.1, =1.29.0, =4.1.0, =2023.5.0b0, =2023.5.0b0, =0.7.3, =2.7.1, =2.7.7 - mqtt-hass-base 4.2.2 and more Source...

c2cciutils (>=1.1.0.dev20260322010408, <=1.1.70), igrafx-mining-sdk (>=2.38.0, <=2.38.1) +13 more potentially affected by CVE-2026-6357 via pip (>=26.0.0, <=26.0.1)

pip PYPI version =26.0.0, =1.1.0.dev20260322010408, =2.38.0, =0.1.1, =0.9.478, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.4.3, =0.1.0, =2.0.0, =2.1.1 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

agave (>=0.1.8, <=0.2.2), argnorm (0.0.1rc1) +6 more potentially affected by CVE-2026-6357 via pip (21.2.4)

pip PYPI version 21.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - agave =0.1.8, =0.2.1, =1.24.1, =0.1.6, =1.0.2, =0.1.0, =0.1.5 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

chalice (>=1.6.2, <=1.8.0), commit-helper (3.4.13) +6 more potentially affected by CVE-2026-6357 via pip (18.1.0)

pip PYPI version 18.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.6.2, =0.1.6, =0.0.3, =3.2.0, =4.0.0 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

chalice (>=1.22.4, <=1.24.0), dpckan (>=0.0.1.9001, <=0.1.0) +6 more potentially affected by CVE-2026-6357 via pip (21.1.3)

pip PYPI version 21.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.22.4, =0.0.1.9001, =0.9.4, =1.0.0, =2.0.0, =2.1.0 - tikit 0.1.7 - wanikani-notifier 0.1.0 - yelpdataset2sql 0.0.2 Source cves: CVE-2026-6357...

aider-chat (>=0.73.0, <=0.74.2), contextualize (>=0.0.4, <=0.0.5) +2 more potentially affected by CVE-2026-6357 via pip (25.0.0)

pip PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aider-chat =0.73.0, =0.0.4, =0.1.7, =0.1.8 - opentips 1.0.0 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

aws-lambda-sls (0.1.0), chalice (1.6.1) +4 more potentially affected by CVE-2026-6357 via pip (18.0.0)

pip PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aws-lambda-sls 0.1.0 - chalice 1.6.1 - lucterios =2.3.0.18073018, =2.3.0.18070609, =2.3.0.18070422, =2.3.1.18112821 - venv-update 3.1.1 Source cves:...

aadetools (>=0.0.3, <=0.0.5), autocut3d (0.1.0) +14 more potentially affected by CVE-2026-6357 via pip (19.2.3)

pip PYPI version 19.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aadetools =0.0.3, =1.10.0, =0.1.4, =0.4.2, =2.0.0, =0.0.4, =0.2.4, =2019.9.2, =2019.10.22 - rtopy 0.1.0 - student-mixture 0.1.10 and more Source cves:...

notebooktoall (>=0.1.7, <=0.2.0), python-dev-tools (>=2019.2.25, <=2019.3.1) potentially affected by CVE-2026-6357 via pip (19.0.2)

pip PYPI version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - notebooktoall =0.1.7, =2019.2.25, =2019.3.1 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

ovsegmentation (1.0.41), pptx2typ (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-6357 via pip (22.0.2)

pip PYPI version 22.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - ovsegmentation 1.0.41 - pptx2typ =0.1.0, =0.1.1 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

agave (0.2.3.dev0), ai-shell-agent (>=0.2.0, <=0.2.2) +30 more potentially affected by CVE-2026-6357 via pip (25.0.1)

pip PYPI version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - agave 0.2.3.dev0 - ai-shell-agent =0.2.0, =0.74.3, =0.1.1, =1.31.4, =0.0.1, =0.0.1, =4.4.3, =0.1.0, =0.1.1 - iflow-mcp-iflytek-ifly-workflow-mcp-server...

lisa-api (0.5.0), lisa-plugins-shopping (>=0.1.9, <=0.2.0) +2 more potentially affected by CVE-2026-6357 via pip (1.5.6)

pip PYPI version 1.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - lisa-api 0.5.0 - lisa-plugins-shopping =0.1.9, =1.0.0rc1, =1.0.0, =1.1.2 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

ais-dom (>=2022.7.7b1, <=2022.7.7), bentoncounty-gistools (>=0.0.1, <=0.0.8) +16 more potentially affected by CVE-2026-6357 via pip (22.1.2)

pip PYPI version 22.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - ais-dom =2022.7.7b1, =0.0.1, =0.1.0, =2022.6.0b0, =2022.6.0b0, =0.1.5, =3.1.0, =0.2.0, =0.2.1 - pdm-shell 1.0.0 - pdm-venv 0.6.0 and more Source cves:...

junctionart (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-6357 via pip (20.3.1)

pip PYPI version 20.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - junctionart =0.1.0, =0.1.2 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

hyperpod-elastic-agent (>=1.1.0, <=1.1.3), jupyter-quant (>=2509.1.0, <=2510.1.0) +5 more potentially affected by CVE-2026-6357 via pip (25.2.0)

pip PYPI version 25.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - hyperpod-elastic-agent =1.1.0, =2509.1.0, =0.1.0, =0.20.0, =3.13.0, =3.13.0, =3.14.0 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...