Python Packaging Authority vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20264

Newest CVEs

• CVE-2026-13346

  pip absolute path traversal during download from malicious package indexes

  Python Packaging Authority · pip

  Medium5.6
• CVE-2026-8643

  pip can extract console_scripts and gui_scripts outside installation directory

  Python Packaging Authority · pip

  Medium4.1
• CVE-2026-3219

  pip doesn't reject concatenated ZIP and tar archives

  Python Packaging Authority · pip

  Medium4.6
• CVE-2026-1703

  Limited path traversal when installing wheel archives

  Python Packaging Authority · pip

  Low2.0
• CVE-2025-8869

  Fallback tar extraction in pip doesn't check symbolic links point to extraction directory

  Python Packaging Authority · pip

  Medium5.9