CVE catalog

CVE-2026-8643

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outs

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-pipsid26.2.2+dfsg-1fixed
Debianpython-pipforky26.2.2+dfsg-1fixed
Debianpython-piptrixie25.1.1+dfsg-1vulnerable
Debianpython-pipbookworm23.0.1+dfsg-1vulnerable
Cpepython-pipNot reportedNot reportedvulnerable
CpepipNot reported26.1.2fixed
PyPIpipNot reported26.1.2fixed
CpepipNot reported26.1.2fixed
Susepython-piplinux enterprise server 16.025.0.1-160000.5.1fixed
Susepython-piplinux enterprise server for sap applications 16.025.0.1-160000.5.1fixed
Opensusepython-pipleap 16.025.0.1-160000.5.1fixed
Opensusepython-piptumbleweed26.1.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-pipsourcesid26.1.2+dfsg-1not yet assignedNot reported[1138220]
Debianpython-pipsourceforky26.1.2+dfsg-1not yet assignedNot reported[1138220]
Debianpython-pipsourcetrixie(unfixed)not yet assignedNot reported[1138220]
Debianpython-pipsourcebookworm(unfixed)not yet assignedNot reported[1138220]
CpepipcpeNot reported26.1.2Not reportedNot reportedNot reported
PyPIpipPyPINot reported26.1.2Not reportedGHSA-WF93-45JW-7689Not reported
CpepipcpeNot reported26.1.2Not reportedNVD-CVE-2026-8643Not reported
Susepython-piprpmlinux enterprise server 16.025.0.1-160000.5.1Not reportedSUSE-SU-2026:22300-1Not reported
Susepython-piprpmlinux enterprise server for sap applications 16.025.0.1-160000.5.1Not reportedSUSE-SU-2026:22300-1Not reported
Opensusepython-piprpmleap 16.025.0.1-160000.5.1Not reportedOPENSUSE-SU-2026:20993-1Not reported
Opensusepython-piprpmtumbleweed26.1.2-1.1Not reportedOPENSUSE-SU-2026:10940-1Not reported

[Debian bug #1138220]

Notes

[trixie] python-pip: Minor issue [bookworm] python-pip: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-pip]Affected

    Source package: [python-pip]

    Details (2)

    • 23.0.1+dfsg-1 · all · bookworm

      Affected

      nvd · python-pip · debian · bookworm; nvd · python-pip · debian · 12

    • 23.0.1+dfsg-1 · all · bookworm

      Affected

      nvd · python-pip · debian · bookworm; nvd · python-pip · debian · 12

  • [python3-pip-whl]Affected

    Source package: [python-pip]

    Details (2)

    • 23.0.1+dfsg-1 · all · bookworm

      Affected

      nvd · python-pip · debian · bookworm; nvd · python-pip · debian · 12

    • 23.0.1+dfsg-1 · all · bookworm

      Affected

      nvd · python-pip · debian · bookworm; nvd · python-pip · debian · 12

[Debian 13 (Trixie)]

  • [python3-pip]Affected

    Source package: [python-pip]

    Details (2)

    • 25.1.1+dfsg-1 · all · trixie

      Affected

      nvd · python-pip · debian · 13

    • 25.1.1+dfsg-1 · all · trixie

      Affected

      nvd · python-pip · debian · 13

  • [python3-pip-whl]Affected

    Source package: [python-pip]

    Details (2)

    • 25.1.1+dfsg-1 · all · trixie

      Affected

      nvd · python-pip · debian · 13

    • 25.1.1+dfsg-1 · all · trixie

      Affected

      nvd · python-pip · debian · 13

[openSUSE Tumbleweed]

  • [python311-pip]Unknown

    Source package: [python-pip]

    Details (1)

    • 26.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 26.1.2-1.1

      Version impact unknown

      nvd · python-pip · opensuse · tumbleweed

  • [python311-pip-wheel]Unknown

    Source package: [python-pip]

    Details (1)

    • 26.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 26.1.2-1.1

      Version impact unknown

      nvd · python-pip · opensuse · tumbleweed

  • [python312-pip]Unknown

    Source package: [python-pip]

    Details (1)

    • 26.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 26.1.2-1.1

      Version impact unknown

      nvd · python-pip · opensuse · tumbleweed

  • [python312-pip-wheel]Unknown

    Source package: [python-pip]

    Details (1)

    • 26.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 26.1.2-1.1

      Version impact unknown

      nvd · python-pip · opensuse · tumbleweed

  • [python313-pip]Unknown

    Source package: [python-pip]

    Details (1)

    • 26.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 26.1.2-1.1

      Version impact unknown

      nvd · python-pip · opensuse · tumbleweed

  • [python313-pip-wheel]Unknown

    Source package: [python-pip]

    Details (1)

    • 26.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 26.1.2-1.1

      Version impact unknown

      nvd · python-pip · opensuse · tumbleweed

  • [python314-pip]Unknown

    Source package: [python-pip]

    Details (1)

    • 26.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 26.1.2-1.1

      Version impact unknown

      nvd · python-pip · opensuse · tumbleweed

  • [python314-pip-wheel]Unknown

    Source package: [python-pip]

    Details (1)

    • 26.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 26.1.2-1.1

      Version impact unknown

      nvd · python-pip · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]