| CVE-2026-13346 |
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary…
|
5.6
Medium
|
Jul 29, 2026 |
| CVE-2026-8643 |
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved…
|
4.1
Medium
|
Jun 1, 2026 |
| CVE-2026-3219 |
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP…
|
4.6
Medium
|
Apr 20, 2026 |
| CVE-2026-1703 |
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the…
|
2.0
Low
|
Feb 2, 2026 |
| CVE-2025-8869 |
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module…
|
5.9
Medium
|
Sep 24, 2025 |