Junglewise Threat Intelligence

CVE-2026-8643: Python pip path traversal via entry point scripts

CVE-2026-8643 · Severity: high · CVSS 8 · Published 2026-06-01

Technologies: pip (PyPI). Vendors: Python Software Foundation, PyPI.

Executive brief

pip, the standard package installer for Python, is vulnerable to a flaw that allows malicious software packages to install files in unauthorized locations on a user's computer. By tricking a user or automated system into installing a specially crafted Python package, an attacker could overwrite system files or place malicious scripts in sensitive directories. This could lead to full system compromise or persistent access to the affected machine.

Technical details

A path traversal vulnerability exists in pip's handling of 'console_scripts' and 'gui_scripts' entry points. The root cause is a failure to sanitize entry point names, which pip treats as paths rather than simple filenames when resolving absolute installation paths. An attacker can exploit this by creating a malicious Python package with entry point names containing directory traversal sequences (e.g., '../'). When a user installs this package via pip, the installer will write executable scripts to arbitrary locations on the filesystem, provided the user running pip has the necessary permissions. This can be used to achieve local privilege escalation or persistence by overwriting known binaries or placing scripts in startup directories. The issue is fixed in pip version 26.1.2.

Affected products

  • Python Software Foundation pip < 26.1.2

Timeline

  • 2026-05-20: patched: Fix merged into pip main branch
  • 2026-06-01: disclosed: Public disclosure and CVE assignment
  • 2026-06-01: advisory: GitHub Advisory published

References

Related threats