Threats affecting pkg:pypi/pip

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

CVE-2026-6357 is a medium severity vulnerability in pip versions prior to 26.1. The issue involves pip running its self-update check after installing wheel files, which requires importing well-known Python modules. This import was deferred to improve startup time but could lead to unintended module imports shortly after installation. The patch changes the self-update check to run before wheel installation to prevent this behavior. Users are advised to review package contents before installation. No known exploits are reported, and no official patch or remediation level is explicitly stated in the advisory.

CVE-2026-3219 is a medium severity vulnerability in the Python Packaging Authority's pip tool. The issue arises because pip treats concatenated tar and ZIP files as ZIP files regardless of the filename or whether the file is both a tar and ZIP archive. This can cause confusing installation behavior, such as installing files that do not match the archive's filename. The updated behavior requires the file to uniquely identify as either a ZIP or tar archive before proceeding with installation.

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.