10740 matches found
PYSEC-2026-196
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
AZL-89463 CVE-2026-8643 affecting package python-virtualenv for versions less than 20.36.1-5
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
AZL-89325 CVE-2026-8643 affecting package python-pip for versions less than 24.2-9
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
CVE-2026-8643
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
EUVD-2026-33682
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
CVE-2026-8643 pip can extract console_scripts and gui_scripts outside installation directory
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
CVE-2026-8643
The pip package installer for Python is vulnerable to a path traversal flaw caused by incorrect pathname restrictions. When installing a malicious Python wheel containing specially crafted entry-point names using absolute paths or directory traversal, pip may write generated script wrappers outsi...
CVE-2026-8643 pip can extract console_scripts and gui_scripts outside installation directory
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
CVE-2026-8643
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...
GHSA-Q53Q-5R4J-5729 rattler has an entry-point path traversal in noarch:python install (arbitrary file write)
Summary EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, , or an...
External Control of File Name or Path
Overview py-rattler is an A blazing fast library to work with the conda ecosystem Affected versions of this package are vulnerable to External Control of File Name or Path via improper validation of the command field in the entry-point installation process. An attacker can write files outside the...
rattler has an entry-point path traversal in noarch:python install (arbitrary file write)
Summary EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, , or an...
MINI-83RX-6HHX-P67Q
Bulletin has no description...
ECHO-14E3-A93D-99BA
Bulletin has no description...
ECHO-74B5-8029-1A64
Bulletin has no description...
PT-2026-45490
Name of the Vulnerable Software and Affected Versions rattler versions prior to 0.43.2 pixi versions prior to 0.69.0 rattler-build versions prior to 0.65.0 py-rattler affected versions not specified Description The EntryPoint::FromStr function in rattler conda types only applies a .trim operation...
PT-2026-45453
FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert. A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp...
PT-2026-47753
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 13031fb6b835 Description A critical guest-to-host escape flaw, dubbed ITScape, exists in the Kernel-based Virtual Machine KVM for ARM64, specifically within the vGIC-ITS Interrupt Translation Service emulation...
CVE-2026-8643: Improper Limitation of a Pathname to a Restricted Directory
pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...