VYPR
Get started
← All advisories
Low severityOSV Advisory· Published Feb 2, 2026· Updated Apr 15, 2026

CVE-2026-1703

CVE-2026-1703

Description

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pipPyPI
< 26.026.0

Affected products

1
  • Pypa/PipOSV
    Range: 0.3, 0.6, 0.7, …

Patches

1
8e227a9be4fa

Merge pull request #13777 from sethmlarson/commonpath

https://github.com/pypa/pipDamian ShawJan 30, 2026via ghsa
commit
3 files changed · +4 −1
  • news/+1ee322a1.bugfix.rst+1 −0 added
    @@ -0,0 +1 @@
+Use a path-segment prefix comparison, not char-by-char.
  • src/pip/_internal/utils/unpacking.py+1 −1 modified
    @@ -83,7 +83,7 @@ def is_within_directory(directory: str, target: str) -> bool:
     abs_directory = os.path.abspath(directory)
     abs_target = os.path.abspath(target)
 
-    prefix = os.path.commonprefix([abs_directory, abs_target])
+    prefix = os.path.commonpath([abs_directory, abs_target])
     return prefix == abs_directory
  • tests/unit/test_utils_unpacking.py+2 −0 modified
    @@ -412,6 +412,8 @@ def test_unpack_tar_unicode(tmpdir: Path) -> None:
         (("parent/", "parent/sub"), True),
         # Test target outside parent
         (("parent/", "parent/../sub"), False),
+        # Test target sub-string of parent
+        (("parent/child", "parent/childfoo"), False),
     ],
 )
 def test_is_within_directory(args: tuple[str, str], expected: bool) -> None:

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.