In short
- CVE-2026-1703 is a LOW (CVSS 2.0) vulnerability affecting pip.
- Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.0% of all vulnerabilities.
- Fix: update to 26.0 or later.
| Package | Affected versions | Patched versions |
|---|
| pip PyPI | < 26.0
| 26.0
|
Description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
NVD description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free