Medium severity5.5NVD Advisory· Published Jun 1, 2026· Updated Aug 24, 2026
CVE-2026-8643
CVE-2026-8643
Description
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pipPyPI | < 26.1.2 | 26.1.2 |
Affected products
13- Package: https://pypi.org/project/pip
- osv-coords10 versionspkg:apk/chainguard/graalvm-25-graalpy-venvpkg:apk/chainguard/nvidia-nsight-compute-13.1pkg:apk/chainguard/nvidia-nsight-compute-13.2pkg:apk/chainguard/nvidia-nsight-compute-13.3pkg:apk/chainguard/request-1276pkg:apk/chainguard/wazuh-manager-framework-fipspkg:rpm/almalinux/python3.14-pippkg:rpm/almalinux/python3.14-pip-wheelpkg:rpm/opensuse/python-pip&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-pip&distro=openSUSE%20Tumbleweed
< 25.0.3-r7+ 9 more
- (no CPE)range: < 25.0.3-r7
- (no CPE)range: < 2025.4.1.2-r2
- (no CPE)range: < 2026.1.1.2-r4
- (no CPE)range: < 2026.2.1.5-r1
- (no CPE)range: < 0.29.1-r2
- (no CPE)range: < 4.14.6-r1
- (no CPE)range: < 25.2-3.el10_2.5
- (no CPE)range: < 25.2-3.el10_2.5
- (no CPE)range: < 25.0.1-160000.5.1
- (no CPE)range: < 26.1.2-1.1
Patches
Vulnerability mechanics
References
45- github.com/pypa/pip/pull/14000nvdIssue TrackingPatchWEB
- www.openwall.com/lists/oss-security/2026/06/01/5nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-wf93-45jw-7689ghsaADVISORY
- mail.python.org/archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/nvdMailing ListVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2026-8643ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:33313nvdWEB
- access.redhat.com/errata/RHSA-2026:34374nvdWEB
- access.redhat.com/errata/RHSA-2026:34456nvdWEB
- access.redhat.com/errata/RHSA-2026:34739nvdWEB
- access.redhat.com/errata/RHSA-2026:34740nvdWEB
- access.redhat.com/errata/RHSA-2026:34741nvdWEB
- access.redhat.com/errata/RHSA-2026:34748nvdWEB
- access.redhat.com/errata/RHSA-2026:34749nvdWEB
- access.redhat.com/errata/RHSA-2026:34750nvdWEB
- access.redhat.com/errata/RHSA-2026:34752nvdWEB
- access.redhat.com/errata/RHSA-2026:34756nvdWEB
- access.redhat.com/errata/RHSA-2026:34758nvdWEB
- access.redhat.com/errata/RHSA-2026:34760nvdWEB
- access.redhat.com/errata/RHSA-2026:34765nvdWEB
- access.redhat.com/errata/RHSA-2026:34772nvdWEB
- access.redhat.com/errata/RHSA-2026:34773nvdWEB
- access.redhat.com/errata/RHSA-2026:34774nvdWEB
- access.redhat.com/errata/RHSA-2026:34775nvdWEB
- access.redhat.com/errata/RHSA-2026:34776nvdWEB
- access.redhat.com/errata/RHSA-2026:34777nvdWEB
- access.redhat.com/errata/RHSA-2026:34778nvdWEB
- access.redhat.com/errata/RHSA-2026:34780nvdWEB
- access.redhat.com/errata/RHSA-2026:34891nvdWEB
- access.redhat.com/errata/RHSA-2026:36193nvdWEB
- access.redhat.com/errata/RHSA-2026:36315nvdWEB
- access.redhat.com/errata/RHSA-2026:37275nvdWEB
- access.redhat.com/errata/RHSA-2026:37283nvdWEB
- access.redhat.com/security/cve/CVE-2026-8643nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yamlghsaWEB
- mail.python.org/archives/list/[email protected]/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJghsaWEB
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.jsonnvdWEB
- access.redhat.com/errata/RHSA-2026:42078nvd
- access.redhat.com/errata/RHSA-2026:42079nvd
- access.redhat.com/errata/RHSA-2026:42132nvd
- access.redhat.com/errata/RHSA-2026:42144nvd
- access.redhat.com/errata/RHSA-2026:42644nvd
- access.redhat.com/errata/RHSA-2026:50479nvd
- access.redhat.com/errata/RHSA-2026:54760nvd
- access.redhat.com/errata/RHSA-2026:56347nvd
News mentions
0No linked articles in our index yet.