CVE-2026-8643

pip can extract console_scripts and gui_scripts outside installation directory

MEDIUM

5.5

CVSS Score

Published: June 1, 2026 at 03:01 PM UTC

Updated: September 16, 2026 at 01:18 PM UTC

15 products affected across 3 vendorsPipEnterprise LinuxOpenShift Container Platform

Using pip by Python Packaging Authority?

Get instant alerts when new vulnerabilities affect pip - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Pip · Pypa

95%

v < 26.1.2

Affected range stops below 26.1.2, so it looks safe — our inference, not a vendor statement

Pip · Python Packaging Authoritypypi

60%

24.0 ≤ v < 26.1.224.0

Affected range stops below 26.1.2, so it looks safe — our inference, not a vendor statement

AI Inference Server · Red Hatcontainer

60%

All versions

Ansible Automation Platform · Red Hatrpm

60%

Vendor states this is fixed in 0:4.6.30-2.el8ap (unaffected)

Vendor states this is fixed in 0:4.6.30-2.el9ap (unaffected)

Vendor states this is fixed in 0:4.7.14-3.el9ap (unaffected)

Vendor states this is fixed in 1782711769 (unaffected)

Vendor states this is fixed in 1782713671 (unaffected)

Vendor states this is fixed in 1782761510 (unaffected)

Vendor states this is fixed in 1783969139 (unaffected)

Vendor states this is fixed in 1784049109 (unaffected)

Vendor states this is fixed in 1785753810 (unaffected)

Developer Hub · Red Hatrpm

60%

All versions

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 0:25.2-3.el10_2.5 (unaffected)

Vendor states this is fixed in 0:25.2-3.el9_8.5 (unaffected)

Vendor states this is fixed in 10 (unaffected)

Vendor states this is fixed in 7 (unaffected)

Vendor states this is fixed in 8 (unaffected)

Enterprise Linux AI · Red Hatrpm

60%

Enterprise Linux Command Line Assistant · Red Hat

60%

All versions

Exploit Intelligence · Red Hatrpm

60%

All versions

Migration Toolkit for Virtualization · Red Hatrpm

60%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (42)

PatchIssue Tracking

Source: cverecord

https://github.com/pypa/pip/pull/14000

Vendor AdvisoryMailing List

Source: cverecord

https://mail.python.org/archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/

Mailing ListThird Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2026/06/01/5