{"action":"Upgrade pip to 26.1.2 or later.","affected":[{"fixed":"26.1.2","introduced":"0"}],"component":"pip","cve_ids":["CVE-2026-8643"],"ecosystem":"PyPI","epss":0.00466,"exploited":false,"fixed_versions":["26.1.2"],"ghsa_id":"GHSA-wf93-45jw-7689","id":"tcs_01M5KG237HDAZXKP902WNZE042","modified_at":"2026-09-10T03:51:09.636289073Z","published_at":"2026-06-01T18:31:53Z","references":["https://osv.dev/vulnerability/GHSA-wf93-45jw-7689","https://nvd.nist.gov/vuln/detail/CVE-2026-8643","https://github.com/pypa/pip/pull/14000","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:34776","https://access.redhat.com/errata/RHSA-2026:34777","https://access.redhat.com/errata/RHSA-2026:34778","https://access.redhat.com/errata/RHSA-2026:34780","https://access.redhat.com/errata/RHSA-2026:34891","https://access.redhat.com/errata/RHSA-2026:36193","https://access.redhat.com/errata/RHSA-2026:36315","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37283","https://access.redhat.com/security/cve/CVE-2026-8643","https://bugzilla.redhat.com/show_bug.cgi?id=2460927","https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml","https://github.com/pypa/pip","https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:34739","https://access.redhat.com/errata/RHSA-2026:34740","https://access.redhat.com/errata/RHSA-2026:34741","https://access.redhat.com/errata/RHSA-2026:34748","https://access.redhat.com/errata/RHSA-2026:34749","https://access.redhat.com/errata/RHSA-2026:34750","https://access.redhat.com/errata/RHSA-2026:34752","https://access.redhat.com/errata/RHSA-2026:34756","https://access.redhat.com/errata/RHSA-2026:34758","https://access.redhat.com/errata/RHSA-2026:34760","https://access.redhat.com/errata/RHSA-2026:34765","https://access.redhat.com/errata/RHSA-2026:34772","https://access.redhat.com/errata/RHSA-2026:34773","https://access.redhat.com/errata/RHSA-2026:34774","https://access.redhat.com/errata/RHSA-2026:34775","http://www.openwall.com/lists/oss-security/2026/06/01/5"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-wf93-45jw-7689","url":"https://osv.dev/vulnerability/GHSA-wf93-45jw-7689"}],"summary":"pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory"}