CVSS 4.0
2.0 lowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCVE-2026-1703
Low (2.0). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in pip 26.0.
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6vgw-5pg2-w6jp | PyPI | pip | <26.0 | 26.0 |
| PYSEC-2026-1796 | PyPI | pip | <26.0 | 26.0 |