pypa/pip Security Advisories | GitStock

medium2026-07-29

pip would incorrectly handle doubly-encoded package URLs from indexes

GHSA-qwm4-qh6w-59xr · CVE-2026-13346

medium2026-06-01

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

GHSA-wf93-45jw-7689 · CVE-2026-8643

medium2026-04-27

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

GHSA-jp4c-xjxw-mgf9 · CVE-2026-6357

medium2026-04-20

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

GHSA-58qw-9mgm-455v · CVE-2026-3219

low2026-02-02

pip Path Traversal vulnerability

GHSA-6vgw-5pg2-w6jp · CVE-2026-1703

medium2025-09-24

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

GHSA-4xh5-x5gv-qwph · CVE-2025-8869

medium2023-10-25

Command Injection in pip when used with Mercurial

GHSA-mq26-g339-26xf · CVE-2023-5752

high2022-05-13

Improper Input Validation in pip

GHSA-g3p5-fjj9-h8gj · CVE-2013-1629

medium2022-05-13

pip lack of randomness in build directory

GHSA-53mr-44pp-crf4 · CVE-2014-8991

medium2022-05-13

Improper Link Resolution Before File Access in pip

GHSA-4gv5-qhvr-36vv · CVE-2013-1888

high2021-11-15

Improper Input Validation in pip

GHSA-5xp3-jfq3-5q8x · CVE-2021-3572

high2021-06-09

Path Traversal in pip

GHSA-gpvv-69j7-gwj8 · CVE-2019-20916