Vulnerability Description
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pypa | Pip | < 26.1.2 |
Related Weaknesses (CWE)
References
- https://github.com/pypa/pip/pull/14000Issue TrackingPatch
- https://mail.python.org/archives/list/[email protected]/thread/YV63UEMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/06/01/5Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2026:33313
- https://access.redhat.com/errata/RHSA-2026:34374
- https://access.redhat.com/errata/RHSA-2026:34456
- https://access.redhat.com/errata/RHSA-2026:34739
- https://access.redhat.com/errata/RHSA-2026:34740
- https://access.redhat.com/errata/RHSA-2026:34741
- https://access.redhat.com/errata/RHSA-2026:34748
- https://access.redhat.com/errata/RHSA-2026:34749
- https://access.redhat.com/errata/RHSA-2026:34750
- https://access.redhat.com/errata/RHSA-2026:34752
- https://access.redhat.com/errata/RHSA-2026:34756
- https://access.redhat.com/errata/RHSA-2026:34758
FAQ
What is CVE-2026-8643?
CVE-2026-8643 is a vulnerability with a CVSS score of 5.5 (MEDIUM). pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outs...
How severe is CVE-2026-8643?
CVE-2026-8643 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-8643?
Check the references section above for vendor advisories and patch information. Affected products include: Pypa Pip.