PT-2026-45480 · Pypi+2 · Pip+2

Damian Shaw + 4 · CVE-2026-8643 · Published 2026-05-28 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pip (affected versions not specified)

Description pip fails to sanitize the resolved absolute path to the installation directory when treating console scripts and gui scripts as paths rather than file names. This allows entry points to be installed outside the intended installation directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALSA-2026:36193

ALSA-2026:36315

BDU:2026-10841

CLEANSTART-2026-KY55512

CLEANSTART-2026-NR60332

CLEANSTART-2026-SA70432

CLEANSTART-2026-UC45646

CLEANSTART-2026-YC81398

CVE-2026-8643

ECHO-E120-768D-97D2

GHSA-WF93-45JW-7689

OESA-2026-2544

OESA-2026-2629

OESA-2026-2630

OESA-2026-2631

OPENSUSE-SU-2026:10940-1

OPENSUSE-SU-2026:20993-1

PYSEC-2026-196

RHSA-2026:34891

RHSA-2026:36193

RHSA-2026:36315

RHSA-2026:42078

RHSA-2026:42079

SUSE-SU-2026:22300-1

SUSE-SU-2026:2634-1

Affected Products

Red Os

Rocky Linux

Pip

References · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8643.json · Exploit
• https://github.com/pypa/pip/pull/14000 · Patch
• https://access.redhat.com/errata/RHSA-2026:34739 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34749 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:42079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6357 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1703 · Security Note
• https://access.redhat.com/errata/RHSA-2026:34760 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34765 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8643 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20993-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34891 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34778 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-8643 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:36315 · Vendor Advisory