pip vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-8643Mediumpip: pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory CVE-2026-6357Mediumpip: pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere CVE-2026-3219Mediumpip: pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files CVE-2026-1703Lowpip: pip Path Traversal vulnerability CVE-2025-8869Mediumpip: pip's fallback tar extraction doesn't check symbolic links point to extraction directory CVE-2023-5752Mediumpip: Command Injection in pip when used with Mercurial CVE-2013-5123Highpip: Improper Authentication in pip CVE-2013-1888Mediumpip: Improper Link Resolution Before File Access in pip CVE-2014-8991Mediumpip: pip lack of randomness in build directory CVE-2013-1629Highpip: Improper Input Validation in pip CVE-2021-3572Highpip: Improper Input Validation in pip CVE-2019-20916Highpip: Path Traversal in pip

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo