pip security

The pip security tag covers vulnerabilities and supply-chain risks in the Python package manager pip, with a focus on Windows environments. Recent discussions highlight CVE-2026-6357, a medium-severity flaw in pip before version 26.1 where a post-install self-update check could execute attacker-controlled code, and CVE-2026-1703, a path-traversal bug in pip's wheel extraction logic that allows files to be placed outside the intended installation directory. These issues underscore that package managers are a growing attack surface for supply-chain and installer attacks, particularly for Windows developers and administrators who rely on pip for Python package management.