In breve
- CVE-2026-1703 è una vulnerabilità BASSO (CVSS 2.0) che riguarda pip.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.44%, superiore al 38.0% delle vulnerabilità.
- Correzione: aggiornare a 26.0 o successiva.
| Package | Affected versions | Patched versions |
|---|
| pip PyPI | < 26.0
| 26.0
|
Description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
NVD description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free