pip security

CVE-2026-6357 is a medium-severity flaw disclosed in April 2026 in pip before version 26.1, where pip’s post-install self-update check could import newly installed Python modules after wheel installation and potentially execute attacker-controlled code in a local install scenario. That...

A subtle bug in pip’s wheel extraction logic has produced CVE‑2026‑1703 — a limited path‑traversal flaw that can allow specially crafted wheel (zip) archives to place files outside the intended installation directory during a normal pip install. The defect is narrowly scoped — the traversal is...