| pip would incorrectly handle doubly-encoded package URLs from indexesCVE-2026-13346 · GHSA-QWM4-QH6W-59XRVersion ranges need review. |
pipRed Hat Enterprise Linux 10/python-pip |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directoryCVE-2026-8643 · GHSA-WF93-45JW-7689Version ranges need review. |
pipExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip Vulnerable to Inclusion of Functionality from Untrusted Control SphereCVE-2026-6357 · GHSA-JP4C-XJXW-MGF9Version ranges need review. |
pipExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP filesCVE-2026-3219 · GHSA-58QW-9MGM-455VVersion ranges need review. |
pipLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip Path Traversal vulnerabilityCVE-2026-1703 · GHSA-6VGW-5PG2-W6JPVersion ranges need review. |
pipLightspeed Core/lightspeed-core/dataverse-exporter-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Command Injection in pip when used with MercurialCVE-2023-5752 · GHSA-MQ26-G339-26XFVersion ranges need review. |
pipRed Hat Enterprise Linux 7/python-pip |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip lack of randomness in build directoryCVE-2014-8991 · GHSA-53MR-44PP-CRF4Version ranges need review. |
pip |
PyPI |
Medium
|
Fix reported |
|
| Improper Input Validation in pipCVE-2021-3572 · GHSA-5XP3-JFQ3-5Q8XVersion ranges need review. |
pipRed Hat Enterprise Linux 7/python-pip |
PyPIRed Hat |
High
|
Fix reported |
|
| Improper Authentication in pipCVE-2013-5123 · GHSA-C5H8-CQ4V-CVFMVersion ranges need review. |
pipOpenShift Enterprise 1/python-virtualenv |
PyPIRed Hat |
High
|
Fix reported |
|
| Path Traversal in pipCVE-2019-20916 · GHSA-GPVV-69J7-GWJ8Version ranges need review. |
pipRed Hat Enterprise Linux 7/python-pip |
PyPIRed Hat |
High
|
Fix reported |
|
| Improper Link Resolution Before File Access in pipCVE-2013-1888 · GHSA-4GV5-QHVR-36VVVersion ranges need review. |
pip |
PyPI |
Medium
|
Fix reported |
|
| Improper Input Validation in pipCVE-2013-1629 · GHSA-G3P5-FJJ9-H8GJVersion ranges need review. |
pip |
PyPI |
High
|
Fix reported |
|
