What’s Vulnerable › Products

Python Packaging Authority pip vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Python Packaging Authority pip version is affected

Latest Python Packaging Authority pip vulnerabilities

• CVE-2026-13346 — pip absolute path traversal during download from malicious package indexes (CVSS 6.5)
• CVE-2026-8643 — pip can extract console_scripts and gui_scripts outside installation directory (CVSS 5.5)
• CVE-2026-6357 — pip self-update functionality can import newly installed modules after wheel installation (CVSS 5.3)
• CVE-2026-3219 — pip doesn't reject concatenated ZIP and tar archives (CVSS 4.6)
• CVE-2026-1703 — Limited path traversal when installing wheel archives (CVSS 2.0)
• CVE-2025-8869 — Fallback tar extraction in pip doesn't check symbolic links point to extraction directory (CVSS 5.9)
• CVE-2023-5752 — Mercurial configuration injectable in repo revision when installing via pip (CVSS 3.3)
• CVE-2021-3572 — (CVSS 5.7)
• CVE-2019-20916 — (CVSS 7.5)
• CVE-2018-20225 — (CVSS 7.8)
• CVE-2013-5123 — (CVSS 5.9)
• CVE-2014-8991 — (CVSS 2.1)
• CVE-2013-1888 — (CVSS 2.1)
• CVE-2013-1629 — (CVSS 6.8)