PyPI/pip CVE-2025-8869: medium 5.9, EPSS 0.49%
pip's fallback tar extraction doesn't check symbolic links point to extraction directory
Action: Upgrade pip to 25.3 or later.
pip install pip==25.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 25.3 | - |
Fixed versions
| 25.3 |
Sources
- osv: GHSA-4xh5-x5gv-qwph
- nvd: CVE-2025-8869
- https://github.com/pypa/pip/pull/13550
- https://github.com/pypa/pip/commit/f2b92314da012b9fffa36b3f3e67748a37ef464a
- https://github.com/pypa/pip
- https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html
- https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN
- https://pip.pypa.io/en/stable/news/#v25-2
CVE-2025-8869 · published · modified · JSON