CVE-2021-3572Medium· 5.7▾ TwilightPoC availableA flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 31.4 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.7%
1.7% → 1.8%
1 GitHub repo
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
pip < 21.1agile_product_lifecycle_management = 9.3.6communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0communications_cloud_native_core_network_function_cloud_native_environment = 22.1.0communications_cloud_native_core_policy = 1.15.0communications_cloud_native_core_policy = 22.1.3Upgrade past the affected range:
pip 21.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
CVE-2021-29425Medium· 4.8In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent di…
CVE-2023-5752Medium· 5.5Command Injection in pip when used with Mercurial
CVE-2026-13346Medium· 6.5pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk e…
CVE-2015-2291High· 7.8(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted …
CVE-2026-3219Mediumpip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files