Skip to content
fr Sign in
2.0 Low

CVE-2026-1703 When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the…

Description

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

Affected products and versions

Product Affected versions Fixed in
pip 26.0 earliest → < 26.0 26.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of pip

The 5 CVEs of pip →
CVE-2026-13346 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary… 5.6 Medium CVE-2026-8643 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved… 4.1 Medium CVE-2026-3219 pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP… 4.6 Medium CVE-2025-8869 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module… 5.9 Medium
Track this CVE