CVE-2026-6357
mediumpriority · track · 0EPSS 0.001 · 3 %ileDEEUFRRUUSEPSS · scored 2026-10-27
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–5.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (32)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2455Oracle Solaris Drittanbieterkomponenten: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- GHSA-jp4c-xjxw-mgf9pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere2026-04-27ghsa · osvUS
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- PYSEC-2026-2876pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere2026-07-13vendor · osvUS
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/pypa/pipPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-6357cnnvd
- https://github.com/pypa/pip/pull/13923enisa_euvd
- https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixesenisa_euvd
- http://www.openwall.com/lists/oss-security/2026/04/27/7nvd
- https://github.com/pypa/pip/pull/13923nvd
- https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixesnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan