Pip
Monthly
Path traversal in pip (CWE-36) allows a malicious package index to write downloaded wheel files to arbitrary filesystem locations outside the intended download directory. The root cause is pip's `Link.filename` property double-decoding percent-encoded URL path segments, letting an attacker embed encoded path separators that survive initial URL parsing but resolve during the second `urllib.parse.unquote()` call. Practical impact is most material for `pip download --only-binary` workflows pointed at untrusted indexes; no public exploit or active exploitation has been identified at time of analysis.
Path traversal during wheel installation in pip allows a malicious package's console_scripts or gui_scripts entry point names to be written outside the intended scripts directory. All pip versions are listed as affected (CPE covers wildcard versions), and exploitation requires a victim to run pip install on a specially crafted package - making this a supply chain attack vector. No public exploit code is identified at time of analysis, no KEV listing exists, and a vendor fix is available upstream via PR #14000, though no specific patched release version is independently confirmed from available intelligence.
Module import confusion in pip before version 26.1 allows a maliciously crafted wheel package to execute arbitrary code within pip's own process by exploiting the sequencing of pip's self-update check relative to wheel installation. Because pip deferred well-known module imports for startup performance and triggered the self-update check after wheels were installed, a freshly installed malicious module could shadow a legitimate import targeted by the self-update routine. No public exploit code is identified at time of analysis, EPSS sits at the 2nd percentile, and SSVC confirms no exploitation, though the CWE-829 root cause carries inherent supply-chain risk.
pip before version 26.1 incorrectly treats concatenated tar and ZIP archives as ZIP files regardless of filename, potentially installing unintended package contents when ambiguous archive formats are processed. Local attackers with user interaction can exploit this during package installation to cause integrity confusion, where an archive's actual contents diverge from its declared format. The vulnerability requires local access and user interaction (downloading/installing a crafted archive), limiting real-world impact to supply-chain scenarios or direct social engineering of pip users.
When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
A flaw was found in python-pip in the way it handled Unicode separators in git references. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity.
An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity.
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity.
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 39.9%.
Path traversal in pip (CWE-36) allows a malicious package index to write downloaded wheel files to arbitrary filesystem locations outside the intended download directory. The root cause is pip's `Link.filename` property double-decoding percent-encoded URL path segments, letting an attacker embed encoded path separators that survive initial URL parsing but resolve during the second `urllib.parse.unquote()` call. Practical impact is most material for `pip download --only-binary` workflows pointed at untrusted indexes; no public exploit or active exploitation has been identified at time of analysis.
Path traversal during wheel installation in pip allows a malicious package's console_scripts or gui_scripts entry point names to be written outside the intended scripts directory. All pip versions are listed as affected (CPE covers wildcard versions), and exploitation requires a victim to run pip install on a specially crafted package - making this a supply chain attack vector. No public exploit code is identified at time of analysis, no KEV listing exists, and a vendor fix is available upstream via PR #14000, though no specific patched release version is independently confirmed from available intelligence.
Module import confusion in pip before version 26.1 allows a maliciously crafted wheel package to execute arbitrary code within pip's own process by exploiting the sequencing of pip's self-update check relative to wheel installation. Because pip deferred well-known module imports for startup performance and triggered the self-update check after wheels were installed, a freshly installed malicious module could shadow a legitimate import targeted by the self-update routine. No public exploit code is identified at time of analysis, EPSS sits at the 2nd percentile, and SSVC confirms no exploitation, though the CWE-829 root cause carries inherent supply-chain risk.
pip before version 26.1 incorrectly treats concatenated tar and ZIP archives as ZIP files regardless of filename, potentially installing unintended package contents when ambiguous archive formats are processed. Local attackers with user interaction can exploit this during package installation to cause integrity confusion, where an archive's actual contents diverge from its declared format. The vulnerability requires local access and user interaction (downloading/installing a crafted archive), limiting real-world impact to supply-chain scenarios or direct social engineering of pip users.
When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
A flaw was found in python-pip in the way it handled Unicode separators in git references. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity.
An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity.
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity.
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 39.9%.