PatchRadar

← Browse

CVE-2026-8643

Low

No strong exploitation signal.

CVSS base
5.5 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS — probability of exploitation (30 days)
0.3%
25.2th percentile
CISA KEV
Not listed
Weakness / dates
CWE-22
Published 2026-06-01 · modified 2026-09-16

CVSS breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack VectorLLocal
Attack ComplexityLLow
Privileges RequiredLLow
User InteractionNNone
ScopeUUnchanged
ConfidentialityNNone
IntegrityHHigh
AvailabilityNNone

Timeline

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Affected

pypa

References

Official: NVD · CVE.org