CVE-2026-8643

What it actually does

This is a path traversal flaw in pip’s handling of Python package entry points. A malicious or compromised package can define console_scripts or gui_scripts entry point names that include path separators, traversal sequences, or absolute-path-like values. During installation, vulnerable pip versions may resolve those names as filesystem paths rather than safe script filenames and write generated launcher scripts outside the intended installation directory, such as outside a virtual environment’s bin/Scripts directory. The main impact is unauthorized file creation or overwrite with the privileges of the user running pip; confidentiality and availability are not directly affected by the flaw itself.

Why it matters to the business

An attacker who can influence a package being installed can cause pip to place executable files in unintended locations, potentially tampering with developer workstations, CI/CD build agents, or packaging environments. The risk is highest where pip installs packages from untrusted sources, where dependency confusion or compromised package feeds are plausible, or where installs are performed with elevated privileges. Although this is not known to be in CISA KEV, has no reported ransomware use, and has low EPSS at 0.0032, it can still affect software supply-chain integrity because pip is widely used across Python development and automation workflows.

How an attack unfolds

An attacker publishes, compromises, or otherwise introduces a Python package containing crafted console_scripts or gui_scripts metadata. The entry point name is constructed to look like a relative or absolute path instead of a simple filename. A victim then installs that package with a vulnerable version of pip, typically through direct installation, dependency resolution, a requirements file, a lockfile update, or an automated build process. When pip processes the package metadata, it generates the script entry point at the attacker-controlled resolved path rather than restricting it to the intended installation scripts directory. If the destination is writable by the pip process, the attacker can create or overwrite a file. Follow-on impact depends on where the file is placed: it may be used to hijack a developer command, modify a build artifact, plant a persistence helper in a user-writable autostart path, or alter files used by later automation steps.

How to fix it

Upgrade pip to a version that contains the vendor fix as soon as an official fixed version is available for the affected distribution. Because no fixed version was provided in the input, track the PyPA/pip advisory and operating system or language-runtime package advisories for the exact patched release. In the interim, reduce exposure by installing packages only from trusted indexes, using pinned dependencies and hash verification, reviewing new or changed packages before installation, and avoiding pip installs with root, administrator, or broadly privileged service accounts. Prefer isolated virtual environments or containers for builds, restrict write permissions on sensitive directories, and prevent CI/CD jobs from installing arbitrary dependencies from public repositories unless explicitly approved.

How to confirm the fix worked

Confirm the installed pip version against the PyPA advisory or distribution package changelog once a fixed version is published. Review Python package metadata before installation, especially entry_points.txt, setup.cfg, setup.py, and pyproject.toml, for console_scripts or gui_scripts names containing ../, ..\\, /, \\, drive-letter paths, or absolute paths. In controlled testing, attempt installation of a benign package with a crafted entry point in an isolated disposable environment and verify that pip rejects or safely normalizes the entry point rather than writing outside the environment’s script directory. Also verify that builds and developer tooling use constrained virtual environments, do not run pip as root/administrator, and use dependency pinning plus hash validation where feasible.

Typical attack path

1. Create or compromise a Python package with malicious console_scripts or gui_scripts entry point metadata containing traversal sequences or path separators.
2. Publish the package to a repository, introduce it through dependency confusion, compromise an internal package feed, or persuade a user or automation job to install it.
3. The target runs vulnerable pip to install the package, often from a requirements file, dependency update, CI job, or manual install command.
4. pip processes the crafted entry point name as a path and writes the generated script outside the intended installation directory.
5. The attacker benefits from file creation or overwrite in a writable location, such as command hijacking, build tampering, or later execution by a user or automation process.

How to detect it

Look for evidence of malicious package installation and unexpected file writes during pip operations. Useful log sources include shell history, CI/CD job logs, package installation logs, endpoint detection telemetry, filesystem auditing, Python package metadata under .dist-info directories, and repository proxy logs for Python package downloads. Search for package metadata defining console_scripts or gui_scripts where the script name contains traversal sequences, forward or backslashes, absolute paths, or Windows drive-letter paths. Review files created or modified at the same time as pip install commands, especially executable scripts outside the expected virtual environment bin or Scripts directory. Investigate pip installs from newly introduced packages, typosquatted package names, direct URLs, editable installs, or nonstandard package indexes. Since there are no known public exploitation campaigns or named threat actors in the input, detection should focus on behavioral artifacts and suspicious package metadata rather than fixed attacker infrastructure.

• console_scripts = ../
• console_scripts = ..\\
• gui_scripts = ../
• gui_scripts = ..\\
• console_scripts = /
• gui_scripts = /
• console_scripts = \\
• gui_scripts = \\
• [console_scripts]
• [gui_scripts]
• entry_points.txt
• pyproject.toml
• setup.cfg
• setup.py
• pip install --extra-index-url
• pip install --index-url
• pip install git+
• pip install -e

What your security team should do

• Inventory pip versions on developer workstations, build agents, containers, and base images; prioritize systems that install Python packages automatically or from external indexes.
• Monitor PyPA and operating system package advisories for the fixed pip release and update base images and build environments promptly when available.
• Block or require review for Python packages whose console_scripts or gui_scripts entry point names contain path traversal sequences, path separators, absolute paths, or Windows drive-letter paths.
• Enforce dependency pinning, trusted package indexes, package allowlists, and hash checking for production and CI/CD installs.
• Avoid running pip with root or administrator privileges; use virtual environments, containers, and least-privilege service accounts.
• Search recent build logs, package metadata, and installed .dist-info directories for suspicious entry point definitions and unexpected files created during pip install operations.
• Treat unexpected executable files appearing outside Python virtual environment script directories immediately after package installation as potentially malicious and investigate the package source.