Vulnerabilities for pip

First version without a known vulnerability: 26.2

Details

• GHSA-qwm4-qh6w-59xr2026-07-29

  pip would incorrectly handle doubly-encoded package URLs from indexes

  Fixed in: 26.2.0, 26.2

• GHSA-wf93-45jw-76892026-06-01

  pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

  Fixed in: 26.1.2

• GHSA-jp4c-xjxw-mgf92026-04-27

  pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

  Fixed in: 26.1

• GHSA-58qw-9mgm-455v2026-04-20

  pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

  Fixed in: 26.1

• GHSA-6vgw-5pg2-w6jp2026-02-02

  pip Path Traversal vulnerability

  Fixed in: 26.0

• GHSA-4xh5-x5gv-qwph2025-09-24

  pip's fallback tar extraction doesn't check symbolic links point to extraction directory

  Fixed in: 25.3

• GHSA-mq26-g339-26xf2023-10-25

  Command Injection in pip when used with Mercurial

  Fixed in: 23.3

• GHSA-c5h8-cq4v-cvfm2022-05-24

  Improper Authentication in pip

  Fixed in: 1.5

• GHSA-4gv5-qhvr-36vv2022-05-13

  Improper Link Resolution Before File Access in pip

  Fixed in: 1.3

• GHSA-53mr-44pp-crf42022-05-13

  pip lack of randomness in build directory

  Fixed in: 6.0

• GHSA-g3p5-fjj9-h8gj2022-05-13

  Improper Input Validation in pip

  Fixed in: 1.3

• GHSA-5xp3-jfq3-5q8x2021-11-15

  Improper Input Validation in pip

  Fixed in: 21.1

• GHSA-gpvv-69j7-gwj82021-06-09

  Path Traversal in pip

  Fixed in: 19.2, a4c735b14a62f9cb864533808ac63936704f2ace