En bref
- CVE-2026-1703 est une vulnérabilité FAIBLE (CVSS 2.0) touchant pip.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.44%, plus élevée que 38.0% des vulnérabilités.
- Correctif : mettre à jour vers 26.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| pip PyPI | < 26.0
| 26.0
|
Description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
NVD description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free