~ / search / GHSA-wf93-45jw-7689

GHSA-wf93-45jw-7689

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-8643

Packages

EcosystemPackageAffectedFixed in
PyPI pip < 26.1.2 26.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

References

External links from the advisory. They lead to third-party sites.