GHSA-wf93-45jw-7689MediumCVSS 8.0

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

Published
June 1, 2026
Last Modified
July 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-8643 →

📋 Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

🎯 Affected products1

  • pip/pip:< 26.1.2

🔗 References (34)