pip versions prior to 26.1 have a vulnerability where the self-update check runs after installing wheel files, causing deferred imports of well-known Python modules that could include functionality from untrusted sources. This behavior was changed in version 26.1 to run the self-update check before wheel installation, preventing newly installed modules from being imported immediately after installation. Users are advised to review package contents before installation.