GitStock

pypa/pip · Security

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

GHSA ID
GHSA-wf93-45jw-7689
CVE ID
CVE-2026-8643
Severity
medium
Published
Updated
CVSS
8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v3
8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4
4.1 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

Open GitHub