Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-8643

28
FAUCET Score

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

First published: Jun 1, 2026Last modified: Jun 30, 2026

Impacted Technologies

VendorProductVersion(s)CPE
< 26.1.2CPE matchmatch criteria
cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

4.1MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
ACTIVE
VS Confidentiality
NONE
VS Integrity
HIGH
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.32%
Probability of exploitation in next 30 days
EPSS Percentile
24.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0032 is in the 81st percentile among its peer group of 15,938 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: azl3 python-virtualenv 20.36.1-4 on Azure Linux 3.0Fixed in: 20.36.1-5
microsoftpatch availablevia msrc
Product: azl3 python-pip 24.2-9 on Azure Linux 3.0Fixed in: 24.2-9
microsoftpatch availablevia msrc
Product: azl3 python-pip 24.2-8 on Azure Linux 3.0Fixed in: 24.2-9
microsoftpatch availablevia msrc
Product: 21388-17084Fixed in: 20.36.1-5
microsoftpatch availablevia msrc
Product: 21480-17084Fixed in: 24.2-9
microsoftpatch availablevia msrc
Product: 21381-17084Fixed in: 24.2-9
pippatch availablevia ghsa
Product: pipFixed in: 26.1.2

Vendor Advisories (2)

microsoft2026-Jun/CVE-2026-8643Moderate

pip can extract console_scripts and gui_scripts outside installation directory

Jun 4, 2026
pipGHSA-wf93-45jw-7689medium

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

Jun 1, 2026

References

access.redhat.com / errata/RHSA-2026:33313
access.redhat.com / errata/RHSA-2026:34374
access.redhat.com / errata/RHSA-2026:34456
access.redhat.com / errata/RHSA-2026:34739
access.redhat.com / errata/RHSA-2026:34740
access.redhat.com / errata/RHSA-2026:34741
access.redhat.com / errata/RHSA-2026:34748
access.redhat.com / errata/RHSA-2026:34749
access.redhat.com / errata/RHSA-2026:34750
access.redhat.com / errata/RHSA-2026:34752
access.redhat.com / errata/RHSA-2026:34756
access.redhat.com / errata/RHSA-2026:34758
access.redhat.com / errata/RHSA-2026:34760
access.redhat.com / errata/RHSA-2026:34765
access.redhat.com / errata/RHSA-2026:34772
access.redhat.com / errata/RHSA-2026:34773
access.redhat.com / errata/RHSA-2026:34774
access.redhat.com / errata/RHSA-2026:34775
access.redhat.com / errata/RHSA-2026:34776
access.redhat.com / errata/RHSA-2026:34777
access.redhat.com / errata/RHSA-2026:34778
access.redhat.com / errata/RHSA-2026:34780
access.redhat.com / errata/RHSA-2026:34891
access.redhat.com / errata/RHSA-2026:36193
access.redhat.com / errata/RHSA-2026:36315
access.redhat.com / errata/RHSA-2026:37275
access.redhat.com / errata/RHSA-2026:37283
access.redhat.com / errata/RHSA-2026:42078
access.redhat.com / errata/RHSA-2026:42079
access.redhat.com / errata/RHSA-2026:42132
access.redhat.com / errata/RHSA-2026:42144
access.redhat.com / errata/RHSA-2026:42644
access.redhat.com / security/cve/CVE-2026-8643
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-8643.json
openwall.com / lists/oss-security/2026/06/01/5
Mailing ListThird Party Advisory
github.com / pypa/pip/pull/14000
Issue TrackingPatch
mail.python.org / archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ
Mailing ListVendor Advisory