pip has 5 CVEs on record between 2023 and 2026. 1 was published in the last 90 days. The median CVSS is 6.0 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.0
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
Products
- pip 5
Worst active — by depth score
CVE-2026-13346Medium· 6.5pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk e…36CVE-2023-5752Medium· 5.5Command Injection in pip when used with Mercurial30CVE-2026-3219Mediumpip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files28CVE-2025-8869Mediumpip's fallback tar extraction doesn't check symbolic links point to extraction directory28CVE-2026-1703Lowpip Path Traversal vulnerability14
pip vulnerabilities
CVEs affecting pip, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-13346Medium· 6.5pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk e…
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from…
CVE-2026-3219Mediumpip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
CVE-2026-1703Lowpip Path Traversal vulnerability
pip Path Traversal vulnerability
CVE-2025-8869Mediumpip's fallback tar extraction doesn't check symbolic links point to extraction directory
pip's fallback tar extraction doesn't check symbolic links point to extraction directory
CVE-2023-5752Medium· 5.5Command Injection in pip when used with Mercurial
Command Injection in pip when used with Mercurial