En resumen
- CVE-2026-1703 es una vulnerabilidad BAJO (CVSS 2.0) que afecta a pip.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.44%, mayor que el 38.0% de las vulnerabilidades.
- Solución: actualizar a 26.0 o posterior.
| Package | Affected versions | Patched versions |
|---|
| pip PyPI | < 26.0
| 26.0
|
Description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
NVD description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free