CVE-2019-20916

The CVE-2019-20916 issue affects the Python pip package prior to 19.2. It enables Directory Traversal when a URL is provided in an install command due to a Content-Disposition header containing ../ in a filename, demonstrated by overwriting /root/.ssh/authorized_keys. The vulnerability is in _int...

CVE-2021-3572

The CVE-2021-3572 issue affects python-pip and stems from how it handles Unicode separators in git references, with the potential to cause a different revision to be installed in a repository. The vulnerability affects data integrity and is mitigated by upgrading to python-pip version 21.1, which...

CVE-2023-5752

The CVE-2023-5752 issue affects python-pip when installing from a Mercurial VCS URL (for example, pip install hg+...), where prior to v23.3 a specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call (for instance --config). This could modify the re...

CVE-2018-20225

CVE-2018-20225 (pip) — The issue affects pip (all versions) where, when using the --extra-index-url option, pip installs the highest-version package, even if a private package is intended from a private index. The exploit condition requires that the private package does not exist in the public in...

CVE-2026-8643

CVE-2026-8643 affects pip: a flaw in how entry-point names in wheel files are handled can cause path traversal and arbitrary file overwrite during wheel installation. Exploitation can overwrite files outside the installation directory. Reports from SUSE, AWS Amazon Linux advisories, and Red Hat r...

CVE-2013-5123

The CVE-2013-5123 issue affects Python-pip prior to 1.5, where the mirroring support (-M/--use-mirrors) performs insecure DNS queries and lacks proper authenticity checks, enabling MITM-like download tampering. Connected advisories confirm this vulnerability and describe the fix as removing the m...

CVE-2013-1888

CVE-2013-1888 : The vulnerable component is the Python package manager pip , where versions prior to 1.3 allow a local attacker to overwrite arbitrary files via a symlink attack in the temporary directory used during pip builds (/_tmp/pip-build). The description and connected documents confirm th...

CVE-2013-1629

CVE-2013-1629 affects the Python package manager pip prior to 1.3, which fetched packages over HTTP from PyPI and did not perform integrity checks. This enables a man-in-the-middle to modify package content and potentially execute arbitrary code during a pip install. Connected advisories (GHSA-G3...

CVE-2026-13346

Pip has a vulnerability (CVE-2026-13346) where doubly-encoded package URLs from indexes can lead to files being installed to arbitrary locations on disk, even when installing wheels. The issue is exploitable only when downloading/installing from a malicious package index; malicious packages alone...

CVE-2014-8991

CVE-2014-8991 affects Python/pip (versions 1.3–1.5.6). The vulnerability allows a local attacker to cause a denial of service by creating a /tmp/pip-build-* file for another user, blocking package installations. Impact is local DoS; no remote exploitation described. Remediation in public advisori...