junctionart (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-8643 via pip (20.3.1)

pip PYPI version 20.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - junctionart =0.1.0, =0.1.2 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

my-flask (2023.4.23), zonesmart-utils (>=0.4.0, <=0.4.1) potentially affected by CVE-2026-8643 via pip (23.0.0)

pip PYPI version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - my-flask 2023.4.23 - zonesmart-utils =0.4.0, =0.4.1 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

chalice (>=1.2.3, <=1.6.0), httptesting (>=1.0.1, <=1.0.2) +4 more potentially affected by CVE-2026-8643 via pip (10.0.1)

pip PYPI version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.2.3, =1.0.1, =4.0.0, =4.0.0, =4.0.1 - zerv 0.1.0 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

justuse (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-8643 via pip (21.2.1)

pip PYPI version 21.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - justuse =0.6.0, =0.6.1 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

geonode (>=4.0.0, <=4.0.0.post1), jpeglib (0.10.16) potentially affected by CVE-2026-8643 via pip (22.2.1)

pip PYPI version 22.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - geonode =4.0.0, =4.0.0.post1 - jpeglib 0.10.16 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

chalice (>=1.6.2, <=1.8.0), commit-helper (3.4.13) +6 more potentially affected by CVE-2026-8643 via pip (18.1.0)

pip PYPI version 18.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.6.2, =0.1.6, =0.0.3, =3.2.0, =4.0.0 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

bighummingbird (>=0.0.2024070102, <=0.0.2024072501) potentially affected by CVE-2026-8643 via pip (24.1.1)

pip PYPI version 24.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - bighummingbird =0.0.2024070102, =0.0.2024072501 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

bentodev (>=0.1.17, <=2018.11.2), clacks (0.1.1.dev845) +6 more potentially affected by CVE-2026-8643 via pip (9.0.1)

pip PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - bentodev =0.1.17, =2.4.0, =0.2.0, =0.1.4, =1.2.0, =1.11.0 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

franka-valve (0.0.0), wildfire-environment (>=0.1.0, <=0.2.1) potentially affected by CVE-2026-8643 via pip (21.0.0)

pip PYPI version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - franka-valve 0.0.0 - wildfire-environment =0.1.0, =0.2.1 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

agi-med-utils (>=0.1.10, <=0.1.19), c2cciutils (1.1.31) +2 more potentially affected by CVE-2026-8643 via pip (23.3.0)

pip PYPI version 23.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - agi-med-utils =0.1.10, =0.0.15, =0.0.16 - resource-schema-guard-rail 0.0.9 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

ais-dom (>=2022.8.2, <=2022.10.5), chalice (>=1.27.2, <=1.27.3) +14 more potentially affected by CVE-2026-8643 via pip (22.2.2)

pip PYPI version 22.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - ais-dom =2022.8.2, =1.27.2, =1.0.0, =0.1.1, =3.3.3, =1.1.2, =2022.8.0b0, =2022.8.0b0, =0.4.1, =4.0.0, =0.11.0, =1.9.0, =1.11.0 and more Source cves:...

sprinter (1.4.2), uranium (>=0.2.8, <=0.2.22) +1 more potentially affected by CVE-2026-8643 via pip (7.1.0)

pip PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - sprinter 1.4.2 - uranium =0.2.8, =0.2.22 - yt-formula-node 0.0.4 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

fastq-handler (>=0.1.0, <=0.2.0), findontime (>=0.1.0, <=0.2.71) potentially affected by CVE-2026-8643 via pip (21.2.3)

pip PYPI version 21.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - fastq-handler =0.1.0, =0.1.0, =0.2.71 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

animo-trainer (1.0.2), build-harness (1.0.1) +16 more potentially affected by CVE-2026-8643 via pip (22.0.4)

pip PYPI version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - animo-trainer 1.0.2 - build-harness 1.0.1 - cacheback2 0.0.5 - cdp-connector =1.0.0, =1.26.6, =1.2.3, =2022.3.0b0, =2022.3.0b0, =0.4.0rc0, =0.6.16,...

aegea (>=2.0.0, <=2.2.5), chalice (>=1.14.1, <=1.16.0) +2 more potentially affected by CVE-2026-8643 via pip (20.1.1)

pip PYPI version 20.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aegea =2.0.0, =1.14.1, =0.1.0, =0.2.0 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

aihandler (>=1.8.15, <=1.9.6), aihandlerwindows (>=1.8.17, <=1.8.19) +15 more potentially affected by CVE-2026-8643 via pip (23.0.1)

pip PYPI version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aihandler =1.8.15, =1.8.17, =1.8.14, =2023.3.0b0, =0.1.1, =2023.3.0b0, =2023.3.0b0, =0.12.0, =0.7.1, =0.7.2 - mqtt-hass-base 4.2.1 - pip-and-pip-tools...

AZL-89463 CVE-2026-8643 affecting package python-virtualenv for versions less than 20.36.1-5

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

chalice (1.12.0), commandfrog (>=0.2.1, <=0.3.1) +12 more potentially affected by CVE-2026-8643 via pip (19.3.1)

pip PYPI version 19.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice 1.12.0 - commandfrog =0.2.1, =0.1.0, =0.8.1, =0.4.11, =0.0.3, =2.4.0.19073113, =0.0.1, =2019.10.25, =0.0.1a0, =0.1.1, =0.1.2 - smartleia 1.0.1...

lisa-api (0.5.0), lisa-plugins-shopping (>=0.1.9, <=0.2.0) +2 more potentially affected by CVE-2026-8643 via pip (1.5.6)

pip PYPI version 1.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - lisa-api 0.5.0 - lisa-plugins-shopping =0.1.9, =1.0.0rc1, =1.0.0, =1.1.2 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

agave (>=0.1.1, <=0.1.7), bankruptcy (>=0.0.2, <=0.0.5) +10 more potentially affected by CVE-2026-8643 via pip (21.0.1)

pip PYPI version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - agave =0.1.1, =0.0.2, =0.2.0, =1.22.1, =0.0.60, =1.0.2, =2.0.3, =0.6.3, =0.0.7, =0.0.39, =0.5.0, =0.5.1 Source cves: CVE-2026-8643 Source advisory:...