CVE-2026-8643Medium· 5.5▾ Sunlitpip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
pip < 26.1.2Upgrade past the affected range:
pip 26.1.2Affected packages:
pip < 26.1.2Patched in:
pip 26.1.2Source: https://osv.dev/vulnerability/GHSA-wf93-45jw-7689
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-8869Medium· 5.3When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known…
CVE-2026-102938Medium· 5.8virtualenv is a tool for creating isolated virtual python environments
CVE-2026-102937High· 7.3virtualenv is a tool for creating isolated virtual python environments
CVE-2026-102930High· 7.7virtualenv is a tool for creating isolated virtual python environments
CVE-2026-102925High· 7.8virtualenv is a tool for creating isolated virtual python environments
CVE-2023-5752Medium· 5.5Command Injection in pip when used with Mercurial