pip vulnerabilities
CVEs whose affected-version data names the pip package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-13346Medium· 6.5pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk e…
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from…
CVE-2026-8643Medium· 5.5⚖ disputedpip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
CVE-2026-3219Mediumpip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
CVE-2026-1703Lowpip Path Traversal vulnerability
pip Path Traversal vulnerability
CVE-2025-8869Mediumpip's fallback tar extraction doesn't check symbolic links point to extraction directory
pip's fallback tar extraction doesn't check symbolic links point to extraction directory
CVE-2023-5752Medium· 5.5Command Injection in pip when used with Mercurial
Command Injection in pip when used with Mercurial
CVE-2021-3572Medium· 5.7PoCA flaw was found in python-pip in the way it handled Unicode separators in git references
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to …