Product by Python Packaging Authority
Pip
5 known vulnerabilities in Pip (Python Packaging Authority), 0 of them actively exploited (CISA KEV).
Key figures
5
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2026-13346 | pip absolute path traversal during download from malicious package indexes | 6.5 | |
| High | CVE-2026-8643 | pip can extract console_scripts and gui_scripts outside installation directory | 5.5 | |
| Medium | CVE-2025-8869 | Fallback tar extraction in pip doesn't check symbolic links point to extraction directory | — | |
| Medium | CVE-2026-3219 | pip doesn't reject concatenated ZIP and tar archives | — | |
| Low | CVE-2026-1703 | Limited path traversal when installing wheel archives | — |