CVE-2026-8643 pip can extract console_scripts and gui_scripts outside installation directory
Attackers can install malicious entry points outside the intended directory via crafted package metadata, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-8643?
CVE-2026-8643 is a medium-severity path traversal vulnerability in Python Packaging Authority pip, published on 1 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-8643?
3 open source packages ship an affected version, including pip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pip PyPI | All versions | 26.1.2 |
pip PyPI | All versions | 26.1.2 |
pip PyPI | All versions | 26.1.2 |
Linux distribution packages (17)
python3.14-pip AlmaLinux:10 | All versions | 25.2-3.el10_2.5 |
python3.14-pip-wheel AlmaLinux:10 | All versions | 25.2-3.el10_2.5 |
python3.14-pip AlmaLinux:9 | All versions | 25.2-3.el9_8.5 |
python3.14-pip-wheel AlmaLinux:9 | All versions | 25.2-3.el9_8.5 |
python3.14-pip Red Hat:enterprise_linux:10.2 | All versions | 0:25.2-3.el10_2.5 |
python3.14-pip-wheel Red Hat:enterprise_linux:10.2 | All versions | 0:25.2-3.el10_2.5 |
python3.14-pip Red Hat:enterprise_linux:9::appstream | All versions | 0:25.2-3.el9_8.5 |
python3.14-pip-wheel Red Hat:enterprise_linux:9::appstream | All versions | 0:25.2-3.el9_8.5 |
python-pip Red Hat:hummingbird:1 | All versions | 0:26.1.1-3.1.hum1 |
python-pip-wheel Red Hat:hummingbird:1 | All versions | 0:26.1.1-3.1.hum1 |
python3-pip Red Hat:hummingbird:1 | All versions | 0:26.1.1-3.1.hum1 |
python3.14-pip Rocky Linux:10 | All versions | 0:25.2-3.el10_2.5 |
python3.14-pip Rocky Linux:9 | All versions | 0:25.2-3.el9_8.5 |
python-pip SUSE:Linux Enterprise Server 16.0 | All versions | 25.0.1-160000.5.1 |
python-pip SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 25.0.1-160000.5.1 |
python-pip openSUSE:Leap 16.0 | All versions | 25.0.1-160000.5.1 |
python-pip openSUSE:Tumbleweed | All versions | 26.1.2-1.1 |
Products include Pypa Pip.
How do I fix CVE-2026-8643?
Upgrade pip to 26.1.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-8643 being exploited?
There is no known exploitation of CVE-2026-8643 in the wild and no public exploit code.
Other vulnerabilities in Python Packaging Authority pip
Sources
Also known as ALSA-2026:36193, ALSA-2026:36315, AZL-89325, AZL-89463, BELL-CVE-2026-8643, CLEANSTART-2026-HB96451 and 25 more.