{"cve":"CVE-2018-20225","nvd":{"published":"2020-05-08T18:15:10.377","modified":"2026-06-17T01:52:28.853","status":"Modified","description":"An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-20"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1835736","https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html","https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arrow.apache.org%3E","https://pip.pypa.io/en/stable/news/","https://bugzilla.redhat.com/show_bug.cgi?id=1835736"],"products":["pypa:pip"],"source":"nvd","synced_at":"2026-10-19T21:04:18.695612450+00:00"},"epss":{"cve":"CVE-2018-20225","score":0.0178,"percentile":0.78251,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}