CVE-2026-8643 — pip can extract console_scripts and gui_scripts outside installation directory

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Affected products

Vendor	Product	Affected	Fixed
Python Packaging Authority	pip	24.0 – < 26.1.2	26.1.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	python-pip	26.1.2+dfsg-1	—
Debian 13	python-pip	No fix yet	—
Debian 12	python-pip	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	python-pip	No fix yet	—
Ubuntu 25.10	python-pip	No fix yet	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 26.04 LTS	python-pip	No fix yet	—
Ubuntu Pro 24.04 LTS	python-pip	No fix yet	—
Ubuntu Pro 22.04 LTS	python-pip	No fix yet	—
Ubuntu Pro 20.04 LTS	python-pip	No fix yet	—
Ubuntu Pro 18.04 LTS	python-pip	No fix yet	—
Ubuntu Pro 16.04 LTS	python-pip	No fix yet	—
Ubuntu Pro 14.04 LTS	python-pip	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	python3.14-pip +1	25.2-3.el10_2.5	RHSA-2026:36193
RHEL 9	python3.14-pip +1	25.2-3.el9_8.5	RHSA-2026:36315

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Hardened Images 1	python-pip +2	26.1.1-3.1.hum1	RHSA-2026:36359, RHSA-2026:34891
Red Hat Ansible Automation Platform Inside 2	ansible-core	1:2.16.19-1.el8ap	RHSA-2026:42079, RHSA-2026:42078
Red Hat Ansible Automation Platform Inside 2	receptor +1	1.6.6-1.el8ap	RHSA-2026:42079, RHSA-2026:42078
Red Hat Ansible Automation Platform Developer 2	ansible-core	1:2.16.19-1.el8ap	RHSA-2026:42079, RHSA-2026:42078
Red Hat Ansible Automation Platform Developer 2	automation-controller +1	4.6.30-2.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform Developer 2	python3.12-urllib3	2.7.0-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform Developer 2	receptor +1	1.6.6-1.el8ap	RHSA-2026:42079, RHSA-2026:42078
Red Hat Ansible Automation Platform 2	ansible-core +1	1:2.16.19-1.el8ap	RHSA-2026:42079, RHSA-2026:42078
Red Hat Ansible Automation Platform 2	automation-controller +4	4.6.30-2.el8ap	RHSA-2026:42079, RHSA-2026:42078
Red Hat Ansible Automation Platform 2	automation-eda-controller +4	1.1.20-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform 2	automation-gateway +2	2.5.20260715-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform 2	automation-gateway-proxy +1	2.6.17-1.el9ap	RHSA-2026:42079
Red Hat Ansible Automation Platform 2	automation-hub +1	4.10.16-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform 2	automation-platform-ui	2.6.11-1.el9ap	RHSA-2026:42079
Red Hat Ansible Automation Platform 2	python3.12-gitpython	3.1.50-1.el8ap	RHSA-2026:42079, RHSA-2026:42078
Red Hat Ansible Automation Platform 2	python3.12-pulp-ansible	1:0.25.6-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform 2	python3.12-pulp-container	2.19.12-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform 2	python3.12-pulpcore	3.49.63-2.el8ap	RHSA-2026:42079, RHSA-2026:42078
Red Hat Ansible Automation Platform 2	python3.12-pyjwt +1	2.13.0-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform 2	python3.12-pysequoia	0.1.34-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform 2	python3.12-urllib3	2.7.0-1.el8ap	RHSA-2026:42078
Red Hat Ansible Automation Platform 2	receptor +1	1.6.6-1.el8ap	RHSA-2026:42079, RHSA-2026:42078

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	python3.14-pip +1	25.2-3.el10_2.5	ALSA-2026:36193
AlmaLinux 9	python3.14-pip +1	25.2-3.el9_8.5	ALSA-2026:36315

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	python3.14-pip	25.2-3.el10_2.5	RLSA-2026:36193
Rocky Linux 9	python3.14-pip	25.2-3.el9_8.5	RLSA-2026:36315

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	python +1	2.7.18-150000.123.1	SUSE-SU-2026:3635-1
SLES 15 SP7	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLES 15 SP6	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLES 15 SP6	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLES 15 SP5	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLES 15 SP5	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLES 15 SP4	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLES 15 SP4	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLES 12 SP5	python +2	2.7.18-33.82.1	SUSE-SU-2026:3862-1
SLES 12 SP5	python3 +1	3.4.10-25.191.2	SUSE-SU-2026:3601-1
SLES 12 SP5	python36 +1	3.6.15-116.1	SUSE-SU-2026:3855-1

Show 22 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 3	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLES for SAP 16.0	python-pip	25.0.1-160000.5.1	SUSE-SU-2026:22300-1
SLES for SAP 15 SP6	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLES for SAP 15 SP6	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLES for SAP 15 SP5	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLES for SAP 15 SP5	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLES for SAP 15 SP4	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLES for SAP 15 SP4	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLES 16.0	python-pip	25.0.1-160000.5.1	SUSE-SU-2026:22300-1
SLE Micro 5.5	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLE Micro 5.4	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLE Micro 5.3	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLE HPC 15 SP5	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLE HPC 15 SP5	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SLE HPC 15 SP4	python-pip	22.3.1-150400.17.26.1	SUSE-SU-2026:2634-1
SLE HPC 15 SP4	python3 +1	3.6.15-150300.10.129.1	SUSE-SU-2026:4754-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy +1	3.11.15-80002.4.15.4	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cffi	1.17.1-80002.3.6.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cryptography	3.3.2-80002.3.6.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cssselect	1.3.0-80002.3.6.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-editables	0.5-80002.3.3.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-exceptiongroup +1	1.2.2-80002.3.3.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-flit-core	3.12.0-80002.3.3.4	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatch-fancy-pypi-readme +1	25.1.0-80002.3.3.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatch-vcs +1	0.5.0-80002.3.3.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatchling	1.31.0-80002.3.3.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-idna	3.10-80002.3.6.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-iniconfig	2.1.0-80002.3.3.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-iniconfig-test	2.1.0-80002.3.3.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-jinja2	3.1.6-80002.5.3.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-lxml	6.1.1-80002.3.9.5	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-packaging	24.2-80002.3.3.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pip	25.0.1-80002.3.3.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyasn1	0.6.3-80002.3.6.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyasn1-modules	0.4.2-80002.3.6.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyopenssl	23.2.0-80002.3.9.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyparsing	3.0.9-80002.3.6.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-requests	2.34.2-80002.4.6.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-tornado	6.3.2-80002.4.12.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-urllib3	2.0.7-80002.3.6.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-websocket-client	1.9.0-80002.3.6.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	scap-security-guide	0.1.80-80002.3.12.4	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	spacecmd	5.2.10-80002.3.15.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	uyuni-tools	5.2.17-80002.3.15.3	SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update	venv-salt-minion	3006.0-80002.5.22.3	SUSE-SU-2026:4581-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	mgr-push	5.2.5-70002.3.12.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy +1	3.11.15-70002.4.15.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cffi	1.17.1-70002.3.6.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cryptography	3.3.2-70002.3.6.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cssselect	1.3.0-70002.3.6.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-editables	0.5-70002.3.3.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-exceptiongroup +1	1.2.2-70002.3.3.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-flit-core	3.12.0-70002.3.3.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatch-fancy-pypi-readme +1	25.1.0-70002.3.3.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatch-vcs +1	0.5.0-70002.3.3.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatchling	1.31.0-70002.3.3.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-idna	3.10-70002.3.6.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-iniconfig	2.1.0-70002.3.3.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-iniconfig-test	2.1.0-70002.3.3.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-jinja2	3.1.6-70002.5.3.2	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-lxml	6.1.1-70002.3.9.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-packaging	24.2-70002.3.3.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pip	25.0.1-70002.3.3.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyasn1	0.6.3-70002.3.6.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyasn1-modules	0.4.2-70002.3.6.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyopenssl	23.2.0-70002.3.9.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyparsing	3.0.9-70002.3.6.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-requests	2.34.2-70002.4.6.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-tornado	6.3.2-70002.4.12.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-urllib3	2.0.7-70002.3.6.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-websocket-client	1.9.0-70002.3.6.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	spacecmd	5.2.10-70002.3.15.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	spacewalk-client-tools	5.2.7-70002.3.12.1	SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update	venv-salt-minion	3006.0-70002.5.22.1	SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools SLE-Micro-5	uyuni-tools	5.2.17-150002.3.20.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-Micro-5	venv-salt-minion	3006.0-150002.5.22.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15	golang-github-prometheus-prometheus	3.13.2-150002.3.19.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15	grafana	12.4.10-150002.4.27.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15	mgr-push	5.2.5-150002.3.12.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15	spacecmd	5.2.10-150002.3.15.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15	spacewalk-client-tools	5.2.7-150002.3.12.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15	uyuni-tools	5.2.17-150002.3.20.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15	venv-salt-minion	3006.0-150002.5.22.1	SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-12	mgr-push	5.2.5-120002.3.12.1	SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools SLE-12	spacecmd	5.2.10-120002.3.15.1	SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools SLE-12	spacewalk-client-tools	5.2.7-120002.3.12.1	SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools SLE-12	uyuni-tools	5.2.17-120002.3.18.1	SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools SLE-12	venv-salt-minion	3006.0-120002.5.22.2	SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools RES-7	mgr-push	5.2.5-70002.3.12.2	SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools RES-7	spacecmd	5.2.10-70002.3.15.1	SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools RES-7	spacewalk-client-tools	5.2.7-70002.3.12.1	SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools RES-7	venv-salt-minion	3006.0-70002.5.22.1	SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools EL-10	scap-security-guide	0.1.80-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE Multi Linux Manager Tools EL-10	spacecmd	5.2.10-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE Multi Linux Manager Tools EL-10	uyuni-tools	5.2.17-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE Multi Linux Manager Tools EL-10	venv-salt-minion	3006.0-100002.1.13.1	SUSE-SU-2026:4580-1
SUSE Multi Linux Manager Tools EL-9	scap-security-guide	0.1.80-90002.3.12.1	SUSE-SU-2026:4582-1
SUSE Multi Linux Manager Tools EL-9	spacecmd	5.2.10-90002.3.15.1	SUSE-SU-2026:4582-1
SUSE Multi Linux Manager Tools EL-9	uyuni-tools	5.2.17-90002.3.15.1	SUSE-SU-2026:4582-1
SUSE Multi Linux Manager Tools EL-9	venv-salt-minion	3006.0-90002.5.22.1	SUSE-SU-2026:4582-1
SUSE Multi Linux Manager Tools EL-8	scap-security-guide	0.1.80-80002.3.12.4	SUSE-SU-2026:4581-1
SUSE Multi Linux Manager Tools EL-8	spacecmd	5.2.10-80002.3.15.3	SUSE-SU-2026:4581-1
SUSE Multi Linux Manager Tools EL-8	uyuni-tools	5.2.17-80002.3.15.3	SUSE-SU-2026:4581-1
SUSE Multi Linux Manager Tools EL-8	venv-salt-minion	3006.0-80002.5.22.3	SUSE-SU-2026:4581-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy +1	3.11.15-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cffi	1.17.1-100002.1.6.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cryptography	3.3.2-100002.1.6.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cssselect	1.3.0-100002.1.6.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-editables	0.5-100002.1.6.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-exceptiongroup +1	1.2.2-100002.1.6.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-flit-core	3.12.0-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatch-fancy-pypi-readme +1	25.1.0-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatch-vcs +1	0.5.0-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatchling	1.31.0-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-idna	3.10-100002.1.6.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-iniconfig	2.1.0-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-iniconfig-test	2.1.0-100002.1.6.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-jinja2	3.1.6-100002.1.6.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-lxml	6.1.1-100002.1.9.2	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-packaging	24.2-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pip	25.0.1-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyasn1	0.6.3-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyasn1-modules	0.4.2-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyopenssl	23.2.0-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyparsing	3.0.9-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-requests	2.34.2-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-tornado	6.3.2-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-urllib3	2.0.7-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-websocket-client	1.9.0-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	scap-security-guide	0.1.80-100002.1.6.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	spacecmd	5.2.10-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	uyuni-tools	5.2.17-100002.1.9.1	SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update	venv-salt-minion	3006.0-100002.1.13.1	SUSE-SU-2026:4580-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy +1	3.11.15-90002.4.15.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cffi	1.17.1-90002.3.6.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cryptography	3.3.2-90002.3.6.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-cssselect	1.3.0-90002.3.6.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-editables	0.5-90002.3.3.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-exceptiongroup +1	1.2.2-90002.3.3.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-flit-core	3.12.0-90002.3.3.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatch-fancy-pypi-readme +1	25.1.0-90002.3.3.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatch-vcs +1	0.5.0-90002.3.3.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-hatchling	1.31.0-90002.3.3.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-idna	3.10-90002.3.6.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-iniconfig	2.1.0-90002.3.3.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-iniconfig-test	2.1.0-90002.3.3.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-jinja2	3.1.6-90002.5.3.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-lxml	6.1.1-90002.3.9.2	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-packaging	24.2-90002.3.3.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pip	25.0.1-90002.3.3.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyasn1	0.6.3-90002.3.6.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyasn1-modules	0.4.2-90002.3.6.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyopenssl	23.2.0-90002.3.9.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-pyparsing	3.0.9-90002.3.6.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-requests	2.34.2-90002.4.6.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-tornado	6.3.2-90002.4.12.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-urllib3	2.0.7-90002.3.6.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	saltbundlepy-websocket-client	1.9.0-90002.3.6.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	scap-security-guide	0.1.80-90002.3.12.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	spacecmd	5.2.10-90002.3.15.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	uyuni-tools	5.2.17-90002.3.15.1	SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update	venv-salt-minion	3006.0-90002.5.22.1	SUSE-SU-2026:4582-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	python-pip	26.1.2-1.1	openSUSE-SU-2026:10940-1
openSUSE Leap 16.0	python-pip	25.0.1-160000.5.1	openSUSE-SU-2026:20993-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	python3-pip +1	21.3.1-2.amzn2023.0.20	ALAS2023-2026-1837
Amazon Linux 2023	python3.11-pip +1	22.3.1-2.amzn2023.0.13	ALAS2023-2026-1839
Amazon Linux 2023	python3.12-pip +1	23.2.1-4.amzn2023.0.10	ALAS2023-2026-1840
Amazon Linux 2023	python3.13-pip +1	24.2-259.amzn2023.0.7	ALAS2023-2026-1841
Amazon Linux 2023	python3.14-pip +1	26.1.1-1.amzn2023.0.2	ALAS2023-2026-1838
Amazon Linux 2	python2-pip +2	20.2.2-1.amzn2.0.18	ALAS2-2026-3358

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	python-pip	24.2-9	—
Azure Linux 3	python-virtualenv	20.36.1-5	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	python3.14-pip +1	25.2-3.el10_2.5	ELSA-2026-36193
Oracle Linux 9	python3.14-pip +1	25.2-3.el9_8.5	ELSA-2026-36315

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	pip	< 26.1.2	26.1.2	GHSA-wf93-45jw-7689

Advisories 37

WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
ALSA-2026:36315 Important: python3.14-pip security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:36193 Important: python3.14-pip security update AlmaLinux Security Advisories · Oct 29, 2026
WID-SEC-2026-2919 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
WID-SEC-2026-2222 Red Hat Enterprise Linux (python-pip): Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 27, 2026
SUSE-SU-2026:4754-1 Security update for python3 SUSE / openSUSE Security Updates · Oct 21, 2026
RHSA-2026:42079 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:42078 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:36359 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:36315 Red Hat Security Advisory: python3.14-pip security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:36193 Red Hat Security Advisory: python3.14-pip security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:34891 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
SUSE-SU-2026:4585-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
SUSE-SU-2026:4583-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
SUSE-SU-2026:4580-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
SUSE-SU-2026:4584-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
SUSE-SU-2026:4581-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
SUSE-SU-2026:4582-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
SUSE-SU-2026:3855-1 Security update for python36 SUSE / openSUSE Security Updates · Sep 4, 2026
SUSE-SU-2026:3862-1 Security update for python SUSE / openSUSE Security Updates · Sep 4, 2026
SUSE-SU-2026:3635-1 Security update for python SUSE / openSUSE Security Updates · Aug 18, 2026
SUSE-SU-2026:3601-1 Security update for python3 SUSE / openSUSE Security Updates · Aug 13, 2026
ELSA-2026-36193 Important: python3.14-pip security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
RLSA-2026:36193 Important: python3.14-pip security update Rocky Linux Security Advisories · Jul 8, 2026
RLSA-2026:36315 Important: python3.14-pip security update Rocky Linux Security Advisories · Jul 8, 2026
ELSA-2026-36315 Important: python3.14-pip security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 7, 2026
SUSE-SU-2026:22300-1 Security update for python-pip SUSE / openSUSE Security Updates · Jul 2, 2026
openSUSE-SU-2026:20993-1 Security update for python-pip SUSE / openSUSE Security Updates · Jun 30, 2026
SUSE-SU-2026:2634-1 Security update for python-pip SUSE / openSUSE Security Updates · Jun 26, 2026
ALAS2-2026-3358 Important: python-pip security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 22, 2026
ALAS2023-2026-1839 Important: python3.11-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
ALAS2023-2026-1840 Important: python3.12-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
ALAS2023-2026-1841 Important: python3.13-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
ALAS2023-2026-1837 Important: python-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
ALAS2023-2026-1838 Important: python3.14-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
openSUSE-SU-2026:10940-1 python311-pip-26.1.2-1.1 on GA media SUSE / openSUSE Security Updates · Jun 3, 2026

CNA	v4.0	4.1
EUVD	v4.0	4.1
OSV:GHSA	v3.1	8.0
OSV:PYSEC	v3.1	5.5
redhat-SADP	v3.1	8.0

pip can extract console_scripts and gui_scripts outside installation directory

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Amazon Linux

Azure Linux

Oracle Linux

Affected packages

Advisories 37

References