CVE-2026-1703
- Source
- https://cve.org/CVERecord?id=CVE-2026-1703
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1703.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-1703
- Aliases
- Downstream
- Related
- Published
- 2026-02-02T15:16:30.510Z
- Modified
- 2026-02-04T21:34:33.388001Z
- Severity
-
- 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
- References
Affected packages
Git / github.com/pypa/pip
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pypa/pip
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
0.*
0.3
0.4
0.5
0.6
0.7
0.7.1
0.8
0.8.1
0.8.2
0.8.3
1.*
1.0
1.0.1
1.0.2
1.1
1.2
1.2.1
1.3
1.3.1
1.3rc1
1.3rc2
1.4
1.4.1
1.4rc1
1.4rc2
1.4rc3
1.4rc4
1.4rc5
1.5
1.5.1
1.5.1rc1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5rc1
1.5rc2
1.5rc3
1.5rc4
10.*
10.0.0
10.0.0b1
10.0.0b2
10.0.1
18.*
18.0
18.1
19.*
19.0
19.0.1
19.0.2
19.0.3
19.1
19.1.1
19.2
19.2.1
19.2.2
19.2.3
19.3
19.3.1
20.*
20.0
20.0.1
20.0.2
20.1
20.1.1
20.1b1
20.2
20.2.1
20.2.2
20.2.3
20.2.4
20.2b1
20.3
20.3.1
20.3.2
20.3.3
20.3b1
21.*
21.0
21.0.1
21.1
21.1.1
21.1.2
21.1.3
21.2.1
21.2.2
21.2.3
21.2.4
21.3
21.3.1
22.*
22.0
22.0.1
22.0.2
22.0.3
22.0.4
22.1
22.1.1
22.1.2
22.1b1
22.2
22.2.1
22.2.2
22.3
22.3.1
23.*
23.0
23.0.1
23.1
23.1.1
23.1.2
23.2
23.2.1
23.3
23.3.1
23.3.2
24.*
24.0
24.1
24.1.1
24.1.2
24.1b1
24.1b2
24.2
24.3
24.3.1
25.*
25.0
25.0.1
25.1
25.1.1
25.2
25.3
6.*
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.1.0
6.1.1
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.1.1
7.1.2
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.1.0
8.1.1
8.1.2
9.*
9.0.0
9.0.1
9.0.2
9.0.3