QSearchQSearch

CVE-2026-8643

5.5 MEDIUM

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the insta...

Published: 2026-06-01 · Last updated: 2026-06-04

Severity and scoring

CVSS
5.5 MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE
CWE-22

Affected products

VendorProduct
pypapip

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-12211 — A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26 (2.7 LOW)
  • CVE-2026-12198 — A weakness has been identified in Microweber up to 2.0.20 (7.3 HIGH)
  • CVE-2026-12089 — The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, an... (4.9 MEDIUM)
  • CVE-2026-11442 — Allegra exportReport Directory Traversal Information Disclosure Vulnerability (6.5 MEDIUM)
  • CVE-2026-53825 — OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gatewa... (6.5 MEDIUM)