pip can extract console_scripts and gui_scripts outside installation directory

...

GHSA-JP4C-XJXW-MGF9 vulnerabilities

Vulnerabilities for packages: py3-pip, tensorflow-cpu-jupyter, kubeflow-katib, datadog-agent, pypy-3.10...

Malicious code in pip-rce (PyPI)

--- -= Per source details. Do not edit below this line.=-...

PT-2020-8665 · Pip +1 · Pip +1

Name of the Vulnerable Software and Affected Versions: pip all versions Description: An issue was discovered in pip because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the...