Threats tagged 'bit-pip-2025-8869'

CVE-2025-8869 is a vulnerability in pip's fallback tar extraction code used with Python versions that do not implement PEP 706. The flaw allows symbolic links in tar archives to point outside the intended extraction directory, potentially leading to unsafe file extraction. Upgrading pip to version 25.3.0 or later addresses this issue. Using Python versions implementing PEP 706 (>=3.9.17, >=3.10.12, >=3.11.4, or >=3.12) also mitigates the risk by avoiding the vulnerable fallback code. Users should also inspect source distributions before installation as a best practice.