CVE-2026-8643: pip can extract console_scripts and gui_scripts outside installation directory

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-01 · updated 2026-09-16
Weakness: CWE-22

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Affected products

Python Packaging Authority pip: before 26.1.2 — fixed in 26.1.2
Pypi Pip: before 26.1.2; 0.2, 0.2.1, 0.3, 0.3.1, 0.4, 0.5 (+150) — fixed in 26.1.2

How to fix

Upgrade to a fixed version: Python Packaging Authority pip 26.1.2; Pypi Pip 26.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-8643 or the next vulnerability affects your stack