DEBIAN-CVE-2026-1703
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-1703
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-1703.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-1703
- Upstream
- Published
- 2026-02-02T15:16:30Z
- Modified
- 2026-09-14T17:02:32Z
- Severity
-
- 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
- References
Affected packages
Debian:12 / python-pip
Package
- Name
- python-pip
- Purl
- pkg:deb/debian/python-pip?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
23.*
23.0.1+dfsg-1
23.1.2+dfsg-1
23.1.2+dfsg-2
23.2+dfsg-1
23.2.1+dfsg-1
23.3+dfsg-1
24.*
24.0+dfsg-1
24.0+dfsg-2
24.1+dfsg-1
24.1.1+dfsg-1
24.2+dfsg-1
24.3.1+dfsg-1
25.*
25.0+dfsg-1
25.0.1+dfsg-1
25.1+dfsg-1
25.1.1+dfsg-1
25.2+dfsg-1
25.3+dfsg-1
26.*
26.0+dfsg-1
26.0.1+dfsg-1
26.1.1+dfsg-1
26.1.2+dfsg-1
Debian:13 / python-pip
Package
- Name
- python-pip
- Purl
- pkg:deb/debian/python-pip?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / python-pip
Package
- Name
- python-pip
- Purl
- pkg:deb/debian/python-pip?arch=source&distro=forky