CVE-2026-8643 – pip can extract console_scripts and gui_scripts outside installation directory

CVE ID :CVE-2026-8643

Published : June 1, 2026, 5:17 p.m. | 1 hour, 15 minutes ago

Description :pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Severity: 4.1 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…