CVE-2026-8643 — pip can extract console_scripts and gui_scripts outside installation directory
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry poin…
Published: 2026-06-01 · CVSS: 4.1 · CVSS 4.0
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7