Vulnerabilidades do Pypa Pip

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Pypa Pip: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:pypa:pip

CVE-2026-8643 Média · 5.5 CWE-22 01/06/2026

pip can extract console_scripts and gui_scripts outside installation directory

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

CVE-2021-3572 Média · 5.7 CWE-20 10/11/2021

Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.