CVE-2026-8643
published 2026-06-01CVE-2026-8643: pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory…
PriorityP426medium5.5CVSS 3.1
AVLACLPRLUINSUCNIHAN
EPSS
0.32%
24.8th percentile
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Affected
134 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9-operator | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9-operator | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9-operator | — | — |
| ansible-automation-platform-26 | hub-rhel9-operator | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9-operator | — | — |
| ansible-automation-platform-26 | platform-resource-rhel9-operator | — | — |
| ansible-automation-platform-27 | aap-cloud-billing-operator-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9-operator | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| discovery | discovery-server-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| migration-toolkit-virtualization | mtv-rhel9-operator | — | — |
| mta | mta-rhel9-operator | — | — |
| mtv-candidate | mtv-rhel9-operator | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| openshift4 | ose-ansible-rhel9-operator | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv4.04.1MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
ghsa·2026-06-01
CVE-2026-8643 [MEDIUM] CWE-22 pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
GHSA
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outs
ghsa_unreviewed·2026-06-01
CVE-2026-8643 [MEDIUM] CWE-22 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outs
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
VulDB
python-pip Installation path traversal
vuldb·2026-05-28
CVE-2026-8643 [CRITICAL] python-pip Installation path traversal
A vulnerability was found in python-pip. It has been classified as critical. The affected element is an unknown function of the component Installation Handler. This manipulation causes path traversal.
The identification of this vulnerability is CVE-2026-8643. The attack can only be executed locally. There is no exploit available.
Red Hat
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
vendor_redhat·2026-05-27·CVSS 8.0
CVE-2026-8643 [HIGH] CWE-22 python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.
Statement: This Important flaw in pip's wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploi
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-8643 python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
bugzilla·2026-06-29·CVSS 5.5
CVE-2026-8643 [MEDIUM] CVE-2026-8643 python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
CVE-2026-8643 python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: python-pip-26.0.1-2.1.hum1
Summary: Path Traversal via Malicious Entry Point Name in Wheel Metadata: A
malicious wheel can use traversal or absolute entry-point names so pip
writes generated script wrappers outside the intended `scheme.scripts`
directory and overwrites files writable by the installing user.
Requirements to exploit: An attacker must induce a victim to install a
malicious wheel. The wheel
Bugzilla
CVE-2026-8643 mingw-python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
bugzilla·2026-06-29·CVSS 5.5
CVE-2026-8643 [MEDIUM] CVE-2026-8643 mingw-python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
CVE-2026-8643 mingw-python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: python-pip-26.0.1-2.1.hum1
Summary: Path Traversal via Malicious Entry Point Name in Wheel Metadata: A
malicious wheel can use traversal or absolute entry-point names so pip
writes generated script wrappers outside the intended `scheme.scripts`
directory and overwrites files writable by the installing user.
Requirements to exploit: An attacker must induce a victim to install a
malicious wheel. The
Bugzilla
CVE-2026-8643 python3.6: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
bugzilla·2026-05-28
CVE-2026-8643 [HIGH] CVE-2026-8643 python3.6: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
CVE-2026-8643 python3.6: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-8643 pypy: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
bugzilla·2026-05-28
CVE-2026-8643 [HIGH] CVE-2026-8643 pypy: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
CVE-2026-8643 pypy: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-8643 python3.15: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
bugzilla·2026-05-28
CVE-2026-8643 [HIGH] CVE-2026-8643 python3.15: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
CVE-2026-8643 python3.15: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-8643 python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
bugzilla·2026-04-22
CVE-2026-8643 [HIGH] CVE-2026-8643 python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
CVE-2026-8643 python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
AI_ONLY_REPORT
package: python-pip-26.0.1-2.1.hum1
Summary: Path Traversal via Malicious Entry Point Name in Wheel Metadata: A
malicious wheel can use traversal or absolute entry-point names so pip
writes generated script wrappers outside the intended `scheme.scripts`
directory and overwrites files writable by the installing user.
Requirements to exploit: An attacker must induce a victim to install a
malicious wheel. The wheel must contain crafted `console_scripts` or
`gui_scripts` names with `../` traversal or absolute-path components in
`entry_points.txt`. The resulting overwrite is limited by the permissions
of the installing user, but pip’s wheel-install fl
https://github.com/pypa/pip/pull/14000https://mail.python.org/archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/http://www.openwall.com/lists/oss-security/2026/06/01/5https://access.redhat.com/errata/RHSA-2026:33313https://access.redhat.com/errata/RHSA-2026:34374https://access.redhat.com/errata/RHSA-2026:34456https://access.redhat.com/errata/RHSA-2026:34739https://access.redhat.com/errata/RHSA-2026:34740https://access.redhat.com/errata/RHSA-2026:34741https://access.redhat.com/errata/RHSA-2026:34748https://access.redhat.com/errata/RHSA-2026:34749https://access.redhat.com/errata/RHSA-2026:34750https://access.redhat.com/errata/RHSA-2026:34752https://access.redhat.com/errata/RHSA-2026:34756https://access.redhat.com/errata/RHSA-2026:34758https://access.redhat.com/errata/RHSA-2026:34760https://access.redhat.com/errata/RHSA-2026:34765https://access.redhat.com/errata/RHSA-2026:34772https://access.redhat.com/errata/RHSA-2026:34773https://access.redhat.com/errata/RHSA-2026:34774https://access.redhat.com/errata/RHSA-2026:34775https://access.redhat.com/errata/RHSA-2026:34776https://access.redhat.com/errata/RHSA-2026:34777https://access.redhat.com/errata/RHSA-2026:34778https://access.redhat.com/errata/RHSA-2026:34780https://access.redhat.com/errata/RHSA-2026:34891https://access.redhat.com/errata/RHSA-2026:36193https://access.redhat.com/errata/RHSA-2026:36315https://access.redhat.com/errata/RHSA-2026:37275https://access.redhat.com/errata/RHSA-2026:37283https://access.redhat.com/errata/RHSA-2026:42078https://access.redhat.com/errata/RHSA-2026:42079https://access.redhat.com/errata/RHSA-2026:42132https://access.redhat.com/errata/RHSA-2026:42144https://access.redhat.com/errata/RHSA-2026:42644https://access.redhat.com/errata/RHSA-2026:50479https://access.redhat.com/errata/RHSA-2026:54760https://access.redhat.com/errata/RHSA-2026:56347https://access.redhat.com/errata/RHSA-2026:60520https://access.redhat.com/security/cve/CVE-2026-8643https://bugzilla.redhat.com/show_bug.cgi?id=2460927https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json
2026-06-01
Published