CVE-2026-8643: pip Path Traversal Vulnerability

CVE-2026-8643 Overview

CVE-2026-8643 is a path traversal vulnerability [CWE-22] in pip, the Python package installer maintained by the Python Packaging Authority (PyPA). The flaw stems from pip treating console_scripts and gui_scripts entry points as paths rather than file names. Because pip fails to sanitize the resolved absolute path against the installation directory, a malicious package can place entry point executables outside the intended scripts directory. An attacker who controls a package definition can leverage this behavior to write executable wrappers to arbitrary filesystem locations writable by the installing user.

Critical Impact
A crafted Python package can install entry point scripts outside the target scripts directory, enabling file overwrite or placement of executables in locations that may be invoked by other users or processes.

Affected Products

pip (Python Packaging Authority installer)
Python environments that install third-party packages defining console_scripts or gui_scripts entry points
Automated CI/CD pipelines and developer workstations that run pip install against untrusted package sources

Discovery Timeline

2026-06-01 - CVE-2026-8643 published to the National Vulnerability Database
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-8643

Vulnerability Analysis

Python packages declare executable entry points through metadata fields named console_scripts and gui_scripts. During installation, pip generates wrapper executables in the environment's scripts directory using the entry point name as the file name. The vulnerable code path in pip does not validate that the resolved absolute output path remains inside the installation directory. When an entry point name contains path separators or traversal sequences, the resolved write location escapes the intended scripts folder. The result is that a package can cause pip to create or overwrite files anywhere the installing user has write access. See the GitHub Pull Request Discussion for the upstream fix and the Python Security Announcement Thread for the coordinated disclosure.

Root Cause

The root cause is missing path sanitization in pip's entry point installation logic. The installer treats the console_scripts and gui_scripts keys as untrusted file path components but writes to the resolved absolute path without confirming that path stays within the destination directory. This is a classic path traversal pattern classified under [CWE-22].

Attack Vector

Exploitation requires local execution with user interaction. A victim must invoke pip install against a malicious or compromised package. The attacker authors a package whose console_scripts or gui_scripts entry name embeds directory traversal characters. When the victim installs the package, pip writes the generated wrapper outside the scripts directory. The wrapper can overwrite a binary in a directory on the user's PATH, plant a script that is later invoked by an automation job, or replace files in adjacent project folders. The vulnerability does not enable direct remote exploitation, but supply chain scenarios involving typosquatted or compromised PyPI packages substantially raise practical risk. Refer to the OpenWall OSS Security List Post for additional technical commentary.

Detection Methods for CVE-2026-8643

Indicators of Compromise

Files written by pip to locations outside the active environment's bin, Scripts, or site-packages directories during installation.
Newly created executables in user home directories, /usr/local/bin, or other PATH locations correlated with recent pip install activity.
Python package metadata where console_scripts or gui_scripts entry names contain /, \, or .. sequences.

Detection Strategies

Audit installed packages for entry point names containing path separators by parsing entry_points.txt files within site-packages.
Monitor process telemetry for pip child processes writing outside the expected installation prefix.
Inspect CI/CD build logs for unexpected file paths emitted during pip install stages.

Monitoring Recommendations

Enable filesystem auditing on directories that contain executables on user PATH and on shared script folders.
Track outbound package downloads from PyPI mirrors and compare hashes against known-good releases before installation.
Alert on pip invocations executed by service accounts or build agents that target packages outside an internal allowlist.

How to Mitigate CVE-2026-8643

Immediate Actions Required

Upgrade pip to the patched release referenced in the GitHub Pull Request Discussion as soon as it is available in your environment.
Restrict pip install operations to vetted, internal package indexes and require hash-pinned requirements files.
Review recently installed packages for suspicious entry point names and remove any package that defines traversal sequences in console_scripts or gui_scripts.

Patch Information

The fix sanitizes entry point names and validates that the resolved installation path remains within the target scripts directory before writing the wrapper. Apply the upstream patch tracked in PyPA pull request pypa/pip#14000. Until the fix is broadly distributed, pin pip to a release that includes the sanitization or apply organization-level controls on package installation sources.

Workarounds

Install packages only from trusted, internally mirrored indexes using --index-url pointing to a curated repository.
Run pip install inside ephemeral, unprivileged containers or virtual environments to limit filesystem write scope.
Require code review of third-party package metadata before promoting dependencies into production lockfiles.
Use pip install --dry-run or pip download followed by manual inspection of package contents before executing installation in sensitive environments.

bash

# Configuration example: constrain pip to a private index and a virtualenv
python -m venv /tmp/safe-env
source /tmp/safe-env/bin/activate
pip install --upgrade pip
pip config set global.index-url https://internal.pypi.example.com/simple/
pip install --require-hashes -r requirements.txt