{
"id": "GHSA-wf93-45jw-7689",
"aliases": [
"CVE-2026-8643"
],
"details": "pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.",
"summary": " pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "26.1.2"
}
]
}
],
"package": {
"name": "pip",
"ecosystem": "PyPI"
}
}
],
"modified": "2026-07-10T12:31:36Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"published": "2026-06-01T18:31:53Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643",
"type": "ADVISORY"
},
{
"url": "https://github.com/pypa/pip/pull/14000",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:33313",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34776",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34777",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34778",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34780",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34891",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36193",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36315",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:37275",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:37283",
"type": "WEB"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-8643",
"type": "WEB"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927",
"type": "WEB"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml",
"type": "WEB"
},
{
"url": "https://github.com/pypa/pip",
"type": "PACKAGE"
},
{
"url": "https://mail.python.org/archives/list/[email protected] /thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ",
"type": "WEB"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34374",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34456",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34739",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34740",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34741",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34748",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34749",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34750",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34752",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34756",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34758",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34760",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34765",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34772",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34773",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34774",
"type": "WEB"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34775",
"type": "WEB"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/01/5",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2026-06-01T17:17:35Z",
"github_reviewed_at": "2026-07-08T21:00:36Z"
}
}