16 matches found
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in pip (CVE-2026-8643)
Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in pip due to a flaw where pip treats consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory. Pip is used in our Speech Service Runtimes...
CVE-2026-114109
The uv package version before 0.11.15 is vulnerable to a path traversal vulnerability (CWE-22). Malicious wheels can exploit this by using crafted console_scripts or gui_scripts entry point names to write files outside the intended scripts directory. If an attacker successfully induces a user to ...
CVE-2026-114109 uv before 0.11.15 Arbitrary File Write via Entry Point Names
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...
CVE-2026-114109 uv before 0.11.15 Arbitrary File Write via Entry Point Names
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...
Astral UV path traversal vulnerability
Versions of Astral UV prior to 0.11.15 have a path traversal vulnerability. This vulnerability arises from improper handling of the names of entry points for custom consolescripts or guiscripts, making them susceptible to path traversal attacks. This could allow malicious wheels to write files...
K000163624: Python vulnerability CVE-2026-8643
Security Advisory Description pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory. CVE-2026-8643 Impact There is no...
EulerOS Virtualization 2.10.0 : python-pip (EulerOS-SA-2026-3883)
According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...
EulerOS Virtualization 2.10.1 : python-pip (EulerOS-SA-2026-3849)
According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...
CLEANSTART-2026-OH23140 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed o...
Multiple security vulnerabilities affect the python3 package. pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory. See...
EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-3716)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-3763)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
EulerOS Virtualization 2.12.1 : python-pip (EulerOS-SA-2026-3612)
According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...
EulerOS 2.0 SP15 : python-pip (EulerOS-SA-2026-3818)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
EulerOS 2.0 SP15 : python-pip (EulerOS-SA-2026-3793)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
CVE-2026-8643
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
CVE-2026-8643: Improper Limitation of a Pathname to a Restricted Directory
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...