CVSS 4.0
5.3 mediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-6357
Medium (5.3). EPSS 0.1% chance of exploitation in the next 30 days. Fixed in pip 26.1.
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
- CWE
- CWE-829
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jp4c-xjxw-mgf9 | PyPI | pip | <26.1 | 26.1 |
| PYSEC-2026-2876 | PyPI | pip | <26.1 | 26.1 |