CVE-2026-1703
NoneCVSS
—
EPSS
0.4%
Published
Feb 2, 2026
CISA due date
—
The record
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | pip | 0 | 26.0 |
| Chainguard | ansible-operator | 0 | 1.42.0-r8 |
| Chainguard | ansible-operator-fips | 0 | 1.42.0-r6 |
| Chainguard | awx | 0 | 24.6.1-r26 |
| Chainguard | dask-gateway | 0 | 2025.4.0-r7 |
| Chainguard | dask-gateway-server | 0 | 2025.4.0-r7 |
| Chainguard | datadog-agent-7.71 | 0 | 7.71.2-r11 |
| Chainguard | datadog-agent-7.71-core-integrations | 0 | 7.71.2-r11 |
| Chainguard | datadog-agent-7.72 | 0 | 7.72.4-r8 |
| Chainguard | datadog-agent-7.72-core-integrations | 0 | 7.72.4-r8 |
| Chainguard | datadog-agent-7.73 | 0 | 7.73.3-r5 |
| Chainguard | datadog-agent-7.73-core-integrations | 0 | 7.73.3-r5 |
| Chainguard | datadog-agent-7.74 | 0 | 7.74.1-r8 |
| Chainguard | datadog-agent-7.74-core-integrations | 0 | 7.74.1-r8 |
| Chainguard | datadog-agent-fips-7.71 | 0 | 7.71.2-r6 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | 0 | 7.71.2-r6 |
| Chainguard | datadog-agent-fips-7.72 | 0 | 7.72.4-r4 |
| Chainguard | datadog-agent-fips-7.72-core-integrations | 0 | 7.72.4-r4 |
| Chainguard | datadog-agent-fips-7.73 | 0 | 7.73.3-r3 |
| Chainguard | datadog-agent-fips-7.73-core-integrations | 0 | 7.73.3-r3 |
| Chainguard | datadog-agent-fips-7.74 | 0 | 7.74.1-r4 |
| Chainguard | datadog-agent-fips-7.74-core-integrations | 0 | 7.74.1-r4 |
| Chainguard | katib-earlystopping | 0 | 0.19.0-r5 |
| Chainguard | katib-suggestion-hyperband | 0 | 0.19.0-r5 |
| Chainguard | katib-suggestion-hyperopt | 0 | 0.19.0-r5 |
| Chainguard | katib-suggestion-nas-darts | 0 | 0.19.0-r5 |
| Chainguard | katib-suggestion-optuna-enas | 0 | 0.19.0-r5 |
| Chainguard | katib-suggestion-pbt-enas | 0 | 0.19.0-r5 |
| Chainguard | katib-suggestion-skopt-enas | 0 | 0.19.0-r5 |
| Chainguard | nemo | 0 | 2.6.1-r4 |
| Chainguard | pgadmin4 | 0 | 9.12-r0 |
| Chainguard | pgadmin4-fips | 0 | 9.12-r0 |
| Chainguard | pypy-3.10 | 0 | 7.3.19-r15 |
| Chainguard | tensorflow-cpu-jupyter | 0 | 2.20.0-r10 |
| Chainguard | tensorflow-gpu-jupyter | 0 | 2.20.0-r9 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | python-pip | 0 | 22.3.1-150400.17.19.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python-pip | 0 | 22.3.1-150400.17.19.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python-pip | 0 | 10.0.1-13.17.1 |
| Wolfi | ansible-operator | 0 | 1.42.0-r8 |
| Wolfi | dask-gateway | 0 | 2025.4.0-r7 |
| Wolfi | dask-gateway-server | 0 | 2025.4.0-r7 |
| Wolfi | datadog-agent-7.72 | 0 | 7.72.4-r8 |
| Wolfi | datadog-agent-7.72-core-integrations | 0 | 7.72.4-r8 |
| Wolfi | datadog-agent-7.73 | 0 | 7.73.3-r5 |
| Wolfi | datadog-agent-7.73-core-integrations | 0 | 7.73.3-r5 |
| Wolfi | datadog-agent-7.74 | 0 | 7.74.1-r8 |
| Wolfi | datadog-agent-7.74-core-integrations | 0 | 7.74.1-r8 |
| Wolfi | katib-earlystopping | 0 | 0.19.0-r5 |
| Wolfi | katib-suggestion-hyperband | 0 | 0.19.0-r5 |
| Wolfi | katib-suggestion-hyperopt | 0 | 0.19.0-r5 |
| Wolfi | katib-suggestion-nas-darts | 0 | 0.19.0-r5 |
| Wolfi | katib-suggestion-optuna-enas | 0 | 0.19.0-r5 |
| Wolfi | katib-suggestion-pbt-enas | 0 | 0.19.0-r5 |
| Wolfi | katib-suggestion-skopt-enas | 0 | 0.19.0-r5 |
| Wolfi | pypy-3.10 | 0 | 7.3.19-r15 |
| Wolfi | tensorflow-cpu-jupyter | 0 | 2.20.0-r10 |
| openSUSE:Leap 15.6 | python-pip | 0 | 22.3.1-150400.17.19.1 |
| openSUSE:Leap 16.0 | python-pip | 0 | 25.0.1-160000.3.1 |
| openSUSE:Tumbleweed | python-pip | 0 | 26.0.1-1.1 |
Related vulnerabilities
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects ansible-operator
- CVE-2026-30922 pyasn1 is a generic ASN.1 library for Python. Also affects ansible-operator
- CVE-2025-58190 The html.Parse function in golang.org/x/net/html has an infinite parsing loop when… Also affects ansible-operator
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects ansible-operator
- CVE-2025-47911 The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when… Also affects ansible-operator
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects ansible-operator
- CVE-2026-24051 OpenTelemetry-Go is the Go implementation of OpenTelemetry. Also affects ansible-operator
- CVE-2026-24049 wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. Also affects ansible-operator