CVE-2026-8643

The pip package installer for Python is vulnerable to a path traversal flaw caused by incorrect pathname restrictions. When installing a malicious Python wheel containing specially crafted entry-point names using absolute paths or directory traversal, pip may write generated script wrappers outsi...

CVE-2026-8643

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

PT-2026-45480

Name of the Vulnerable Software and Affected Versions pip affected versions not specified Description pip fails to sanitize the resolved absolute path to the installation directory when treating console scripts and gui scripts as paths rather than file names. This allows entry points to be...