Skip to main content

pip CVE-2026-6357

| EUVDEUVD-2026-25857 MEDIUM
Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
2026-04-27 PSF
Information Disclosure Python Pip
5.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.4 HIGH

Local vector because exploitation occurs on the victim's system during pip execution; AC:H for the module-name collision prerequisite (mapped from CVSS 4.0 AT:P); PR:N as the attacker needs no system privileges, only the ability to distribute a package; UI:R for the required victim action of running pip install; S:C and C:H/I:H reflecting code execution within pip's potentially privileged process.

3.1 AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
4.0 AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
5.8 MEDIUM
AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Red Hat
5.8 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
A
Scope
X

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 24, 2026 - 01:59 vuln.today
Analysis Generated
Jul 24, 2026 - 01:59 vuln.today
CVSS changed
Apr 27, 2026 - 15:22 NVD
5.3 (MEDIUM)
EUVD ID Assigned
Apr 27, 2026 - 15:00 euvd
EUVD-2026-25857
Patch released
Apr 27, 2026 - 15:00 nvd
Patch available
CVE Published
Apr 27, 2026 - 14:19 nvd
MEDIUM 5.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 pypi packages depend on pip (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 26.1.

DescriptionCVE.org

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

AnalysisAI

Module import confusion in pip before version 26.1 allows a maliciously crafted wheel package to execute arbitrary code within pip's own process by exploiting the sequencing of pip's self-update check relative to wheel installation. Because pip deferred well-known module imports for startup performance and triggered the self-update check after wheels were installed, a freshly installed malicious module could shadow a legitimate import targeted by the self-update routine. No public exploit code is identified at time of analysis, EPSS sits at the 2nd percentile, and SSVC confirms no exploitation, though the CWE-829 root cause carries inherent supply-chain risk.

Technical ContextAI

pip deferred certain Python module imports to reduce CLI startup latency, and the self-version check (pip_self_version_check / handle_pip_version_check) was invoked after wheel installation completed. Python's import system resolves module names by searching sys.path, which includes site-packages directories where newly installed wheels land. A malicious wheel that places a module with the same name as one pip imports during the self-update phase can shadow the intended module, causing pip to load and execute the attacker-controlled code. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) precisely describes this flaw: pip inadvertently incorporates functionality from an untrusted location it does not control. The patch in PR #13923 refactors the self-version check into a context manager with a fetch phase (before wheel installation) and an emit phase (after), ensuring all relevant module imports occur before any wheel content is written to disk.

RemediationAI

Upgrade pip to version 26.1 or later using pip install --upgrade pip; this is the vendor-released patch confirmed by the PSF advisory at https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes and the upstream fix at https://github.com/pypa/pip/pull/13923. Red Hat and SUSE users should apply updated packages through their respective vendor channels as they become available. As a compensating control for environments that cannot immediately upgrade, setting the environment variable PIP_DISABLE_PIP_VERSION_CHECK=1 or passing --disable-pip-version-check to pip disables the self-update check entirely, closing the vulnerable code path at the cost of losing version-upgrade notifications. This workaround has no functional impact on package installation itself. The PSF also recommends that users review package contents before installation as a general practice regardless of pip version.

More in Python

View all
CVE-2025-24016 CRITICAL POC
9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2024-21644 HIGH POC
7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
CVE-2026-33017 CRITICAL POC
9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
CVE-2017-9462 HIGH POC
8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
CVE-2026-49869 CRITICAL POC
10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2024-21645 MEDIUM POC
5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

View all
CVE-2025-32463 CRITICAL POC
9.3
CVE-2026-0770 CRITICAL POC
9.8
CVE-2025-27607 HIGH POC
8.8
CVE-2026-1699 CRITICAL POC
10.0
CVE-2026-27941 CRITICAL POC
9.9
CVE-2020-8128 CRITICAL POC
9.8
CVE-2019-13589 CRITICAL POC
9.8
CVE-2018-15486 CRITICAL POC
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed

Share

CVE-2026-6357 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy