pip vulnerabilities
CVEs whose affected-version data names the pip package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-8643Medium· 5.5⚖ disputedpip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
CVE-2026-1703Lowpip Path Traversal vulnerability
pip Path Traversal vulnerability
CVE-2025-8869Medium· 5.3When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known…
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known…
CVE-2023-5752Medium· 5.5Command Injection in pip when used with Mercurial
Command Injection in pip when used with Mercurial
CVE-2021-3572Medium· 5.7PoCA flaw was found in python-pip in the way it handled Unicode separators in git references
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to …