pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-8643US | medium5.5 | — | ||
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/06/01/5WEB
- https://access.redhat.com/errata/RHSA-2026:33313WEB
- https://access.redhat.com/errata/RHSA-2026:34374WEB
- https://access.redhat.com/errata/RHSA-2026:34456WEB
- https://access.redhat.com/errata/RHSA-2026:34739WEB
- https://access.redhat.com/errata/RHSA-2026:34740WEB
- https://access.redhat.com/errata/RHSA-2026:34741WEB
- https://access.redhat.com/errata/RHSA-2026:34748WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan