Skip to content
fr Sign in
4.1 Medium

CVE-2026-8643 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved…

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Affected products and versions

Product Affected versions Fixed in
pip 24.0 24.0 → < 26.1.2 26.1.2
Red Hat Discovery 2 1786638573 earliest → < 1786638573 1786638573
Red Hat Discovery 2 1782763840 earliest → < 1782763840 1782763840
Exploit Intelligence Versions not published
Migration Toolkit for Applications 8 Versions not published
Migration Toolkit for Virtualization Versions not published
Pen Drive Powered by Red Hat Lightspeed Versions not published
Red Hat AI Inference Server Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Show the 32 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Hardened Images 26.1 earliest → < 26.1.1-3.1.hum1 26.1.1-3.1.hum1
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Trusted Artifact Signer Versions not published
OpenShift Lightspeed Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Quay 3 Versions not published
Service Telemetry Framework 1.5 Versions not published
Red Hat Ansible Automation Platform 2.6 1785753810 earliest → < 1785753810 1785753810
Red Hat OpenShift AI 3.0 1782928977 earliest → < 1782928977 1782928977
Red Hat OpenShift AI 3.2 1782914629 earliest → < 1782914629 1782914629
Red Hat OpenShift AI 3.3 1782991170 earliest → < 1782991170 1782991170
Red Hat OpenShift AI 3.4 1787073593 earliest → < 1787073593 1787073593
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat Trusted Artifact Signer 1.4 1782485441 earliest → < 1782485441 1782485441
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.5 1784049109 earliest → < 1784049109 1784049109
Red Hat OpenShift AI 2.25 1782475830 earliest → < 1782475830 1782475830
Lightspeed Core Versions not published
Red Hat Enterprise Linux command line assistant Versions not published
Red Hat Migration Toolkit for Applications 8.2 1786481481 earliest → < 1786481481 1786481481

References

Timeline

  1. Published
  2. Last modified

Other CVEs of pip

The 5 CVEs of pip →
CVE-2026-13346 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary… 5.6 Medium CVE-2026-3219 pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP… 4.6 Medium CVE-2026-1703 When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the… 2.0 Low CVE-2025-8869 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module… 5.9 Medium
Track this CVE