Logo
componentpython3-pip
Name
python3-pip
Version
24.0
Type
library
Description
The PyPA recommended tool for installing Python packages
Licenses
MIT & Apache-2.0 & MPL-2.0 & LGPL-2.1-only & BSD-3-Clause & PSF-2.0 & BSD-2-Clause
PURL
-
CPE
cpe:2.3:*:*:python3-pip:24.0:*:*:*:*:*:*:*

Other Versions#


Project
Branch
Version
kirkstone
22.0.3
master
26.1.2

Patches#


#
Title
Author
Resolve
1
python3-pip: Don't change shebang
Richard Purdie <richard.purdie@linuxfoundation.org>
2
Use os.path.commonpath() instead of commonprefix()
Seth Michael Larson <seth@python.org>
CVE-2026-1703

Vulnerabilities#


Name
Analysis
Description
Patched
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.