aiomobilevikings (0.1.0), aiorobonect (>=1.1.0, <=1.1.3) +5 more potentially affected by CVE-2026-8643 via pip (24.1.2)

pip PYPI version 24.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aiomobilevikings 0.1.0 - aiorobonect =1.1.0, =0.4.0, =4.4.0, =2.0.0.post0, =2.0.2 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

codecraft-chat (>=0.82.4.dev64, <=0.82.4.dev69), cryptobot-python (0.1.9) +2 more potentially affected by CVE-2026-8643 via pip (25.1.0)

pip PYPI version 25.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - codecraft-chat =0.82.4.dev64, =0.0.21, =0.2.8 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

aima (2023.2.4), aiogram-inline-paginations (>=0.1.0, <=0.1.12) +84 more potentially affected by CVE-2026-8643 via pip (22.3.1)

pip PYPI version 22.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aima 2023.2.4 - aiogram-inline-paginations =0.1.0, =2022.11.0b1, =0.1.2, =0.1.2, =1.0.1, =0.1.1.1, =1.0.2, =0.10.0, =0.0.5, =0.0.0.2, =0.0.1.0 and more...

chalice (>=1.22.4, <=1.24.0), dpckan (>=0.0.1.9001, <=0.1.0) +6 more potentially affected by CVE-2026-8643 via pip (21.1.3)

pip PYPI version 21.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.22.4, =0.0.1.9001, =0.9.4, =1.0.0, =2.0.0, =2.1.0 - tikit 0.1.7 - wanikani-notifier 0.1.0 - yelpdataset2sql 0.0.2 Source cves: CVE-2026-8643...

aider-chat (>=0.73.0, <=0.74.2), contextualize (>=0.0.4, <=0.0.5) +2 more potentially affected by CVE-2026-8643 via pip (25.0.0)

pip PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aider-chat =0.73.0, =0.0.4, =0.1.7, =0.1.8 - opentips 1.0.0 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

auto-dl (0.1.1), chalice (>=1.0.1, <=1.2.2) +14 more potentially affected by CVE-2026-8643 via pip (9.0.3)

pip PYPI version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - auto-dl 0.1.1 - chalice =1.0.1, =1.5.119, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =1.5.6, =0.2.0, =2.1.6.16123016, =2.1.1.16070814,...

dsframework (>=0.1.9, <=0.1.12), hes-off (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-8643 via pip (21.1.1)

pip PYPI version 21.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - dsframework =0.1.9, =1.0.0, =1.0.1 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

aftool (>=0.1.2, <=0.2.8), agave (>=0.0.3, <=0.1.3.dev2) +23 more potentially affected by CVE-2026-8643 via pip (20.3.4)

pip PYPI version 20.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aftool =0.1.2, =0.0.3, =0.1.0.dev1, =1.21.5, =0.4.0, =1.0.2, =0.1.59, =0.4.3, =0.2.1, =2.6.0b1, =2020.0.1, =0.1.0, =2.4.6.20013014, =2.4.0.19073113,...

pycellfit (>=0.2.0, <=0.2.3) potentially affected by CVE-2026-8643 via pip (20.2.0)

pip PYPI version 20.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - pycellfit =0.2.0, =0.2.3 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

fastq-handler (>=0.1.0, <=0.2.0), findontime (>=0.1.0, <=0.2.71) potentially affected by CVE-2026-8643 via pip (21.2.3)

pip PYPI version 21.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - fastq-handler =0.1.0, =0.1.0, =0.2.71 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

GHSA-WF93-45JW-7689 pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

python-dev-tools (>=2019.4.24, <=2019.5.3) potentially affected by CVE-2026-8643 via pip (19.1.0)

pip PYPI version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.4.24, =2019.5.3 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

dpckan (0.0.1.9000), pysqream-log-analyzer (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-8643 via pip (21.1.2)

pip PYPI version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - dpckan 0.0.1.9000 - pysqream-log-analyzer =0.0.1, =0.1.8, =0.1.10 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

magellan (1.0.0b0), sprinter (1.4.1) potentially affected by CVE-2026-8643 via pip (6.1.1)

pip PYPI version 6.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - magellan 1.0.0b0 - sprinter 1.4.1 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

aihandler (>=1.9.8, <=1.19.0), aiorobonect (>=0.2.3, <=0.2.5) +18 more potentially affected by CVE-2026-8643 via pip (23.1.2)

pip PYPI version 23.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aihandler =1.9.8, =0.2.3, =1.10.0, =2023.5.1, =1.29.0, =4.1.0, =2023.5.0b0, =2023.5.0b0, =0.7.3, =2.7.1, =2.7.7 - mqtt-hass-base 4.2.2 and more Source...

sprinter (1.4.2), uranium (>=0.2.8, <=0.2.22) +1 more potentially affected by CVE-2026-8643 via pip (7.1.0)

pip PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - sprinter 1.4.2 - uranium =0.2.8, =0.2.22 - yt-formula-node 0.0.4 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

ais-dom (>=2022.7.7b1, <=2022.7.7), bentoncounty-gistools (>=0.0.1, <=0.0.8) +16 more potentially affected by CVE-2026-8643 via pip (22.1.2)

pip PYPI version 22.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - ais-dom =2022.7.7b1, =0.0.1, =0.1.0, =2022.6.0b0, =2022.6.0b0, =0.1.5, =3.1.0, =0.2.0, =0.2.1 - pdm-shell 1.0.0 - pdm-venv 0.6.0 and more Source cves:...

chalice (>=1.6.2, <=1.8.0), commit-helper (3.4.13) +6 more potentially affected by CVE-2026-8643 via pip (18.1.0)

pip PYPI version 18.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.6.2, =0.1.6, =0.0.3, =3.2.0, =4.0.0 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

c2cciutils (>=1.1.16, <=1.1.30), ddpw (2.0.0) +1 more potentially affected by CVE-2026-8643 via pip (22.0.3)

pip PYPI version 22.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - c2cciutils =1.1.16, =0.4.2, =0.5.4 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

aef-gw (>=0.1.1, <=0.1.15), africanwhisper (>=0.2.1, <=0.9.0) +37 more potentially affected by CVE-2026-8643 via pip (24.0.0)

pip PYPI version 24.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aef-gw =0.1.1, =0.2.1, =1.0.2, =0.1.0, =1.0.3, =1.31.1, =2.4.3b1, =1.2.0, =0.3.3, =4.3.0, =2.35.2, =2.36.1 and more Source cves: CVE-2026-8643 Source...