PT-2026-35435 · Pypi+1 · Pip+1

Damian Shaw + 2 · CVE-2026-6357 · Publicado 2026-04-27 · Atualizado 2026-07-21

Positive Technologies (AI Summary) · Pt

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:N

Nome do Software Vulnerável e Versões Afetadas pip versões anteriores a 26.1

Descrição A funcionalidade de verificação de autoatualização é executada após a instalação de arquivos wheel, o que requer a importação de nomes de módulos Python conhecidos. Essas importações foram adiadas para melhorar o tempo de inicialização da CLI do pip. Esse comportamento permite que módulos recém-instalados sejam importados logo após a instalação de um pacote wheel.

Recomendações Atualize para a versão 26.1 ou posterior. Revise o conteúdo dos pacotes antes da instalação.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

BDU:2026-09786

CLEANSTART-2026-DD95169

CLEANSTART-2026-HZ86045

CLEANSTART-2026-KY55512

CLEANSTART-2026-NN42198

CLEANSTART-2026-NR60332

CLEANSTART-2026-QK55639

CLEANSTART-2026-SA70432

CLEANSTART-2026-SY44974

CLEANSTART-2026-UC45646

CLEANSTART-2026-YC81398

CLEANSTART-2026-ZI38454

CLEANSTART-2026-ZO99127

CVE-2026-6357

ECHO-0A2A-4462-0B2A

GHSA-JP4C-XJXW-MGF9

OPENSUSE-SU-2026:20880-1

PYSEC-2026-2876

SUSE-SU-2026:22018-1

SUSE-SU-2026:2387-1

SUSE-SU-2026:2634-1

SUSE-SU-2026:2664-1

SUSE-SU-2026:2758-1

Produtos afetados

Red Os

Pip

Referências · 142

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6357.json · Exploit
• https://github.com/pypa/pip/commit/b369bfc96cc524e00c267e1693290e6599c36bad · Nota
• https://github.com/pypa/pip/pull/13923 · Correção
• https://github.com/pypa/pip · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ZO99127.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DD95169.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YC81398.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UC45646.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SA70432.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ZI38454.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NR60332.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KY55512.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SY44974.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-QK55639.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HZ86045.json · Nota