PT-2026-35435 · Pypi · Pip

Damian Shaw + 2 · Published 2026-04-27 · Updated 2026-05-18 · CVE-2026-6357

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions pip versions prior to 26.1

Description The self-update check functionality runs after installing wheel files, which requires importing well-known Python module names. These imports were deferred to improve the startup time of the pip CLI. This behavior allows newly installed modules to be imported shortly after the installation of a wheel package.

Recommendations Update to version 26.1 or later. Review package contents prior to installation.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CLEANSTART-2026-HZ86045

CLEANSTART-2026-QK55639

CLEANSTART-2026-SY44974

CVE-2026-6357

ECHO-0A2A-4462-0B2A

GHSA-JP4C-XJXW-MGF9

Affected Products

Pip

References · 67

• https://github.com/pypa/pip/pull/13923 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-2104 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-3219 · Security Note
• https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-QK55639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8492 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-16056 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6232 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-27043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44432 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59375 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-6357 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-6357 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-6357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6923 · Security Note