Em resumo
- CVE-2026-1703 é uma vulnerabilidade BAIXO (CVSS 2.0) que afeta pip.
- Chance de exploração nos próximos 30 dias (EPSS): 0.44%, maior que 38.0% das vulnerabilidades.
- Correção: atualize para 26.0 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| pip PyPI | < 26.0
| 26.0
|
Description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
NVD description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free