CVE-2026-8643 json
pip can extract console_scripts and gui_scripts outside installation directory
published 2026-06-01 5 mo ago modified 2026-09-16 54 d ago also GHSA-wf93-45jw-7689 , PYSEC-2026-196 , EUVD-2026-33682
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Patch / fix
- pypi pip 26.1.2
- Python Packaging Authority pip 26.1.2
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.30-2.el8ap
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.30-2.el9ap
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.14-3.el9ap
- Red Hat Red Hat Enterprise Linux 10 0:25.2-3.el10_2.5
- Red Hat Red Hat Enterprise Linux 9 0:25.2-3.el9_8.5
- Red Hat Red Hat Ansible Automation Platform 2.5 1784049109
- Red Hat Red Hat Ansible Automation Platform 2.6 1782711769, 1782713671, 1782761510, 1783969139, 1785753810
- Red Hat Red Hat Discovery 2 1782763840, 1786638573
- Red Hat Red Hat Hardened Images 26.1.1-3.1.hum1, 26.1.2-1.hum1
- Red Hat Red Hat Migration Toolkit for Applications 8.2 1786481481
- Red Hat Red Hat OpenShift AI 2.25 1782475830, 1783024305, 1783082430, 1783342900, 1783998418
- Red Hat Red Hat OpenShift AI 3.0 1782928977, 1782928984, 1782929069, 1782929133, 1782968171
- Red Hat Red Hat OpenShift AI 3.2 1782914629, 1782914721, 1782914751, 1782914833, 1782915184, 1782915416
- Red Hat Red Hat OpenShift AI 3.3 1782471555, 1782471579, 1782471656, 1782471663, 1782887848, 1782914644, 1782914653, 1782914706, 1782914779, 1782914960, 1782915015, 1782915056, 1782916020, 1782991170, 1783010225, 1783069204, 1783073038
- Red Hat Red Hat OpenShift AI 3.4 1782132163, 1782132167, 1782132207, 1782132236, 1782132237, 1782132240, 1782132286, 1782132297, 1782133213, 1782135346, 1782135464, 1782136276, 1782726504, 1786612415, 1786612637, 1786635926, 1787073459, 1787073866, 1787073873, 1787073936
- Red Hat Red Hat Trusted Artifact Signer 1.4 1782485441
- python-pip Debian 14 26.1.2+dfsg-1
debian advisories DEBIAN-CVE-2026-8643
- receptor ansible automation platform 2.6 1.6.6-1.el10ap
- receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.6-1.el9ap
- ansible-core ansible automation platform developer 2.6, ansible automation platform 2.6 2:2.16.19-1.el10ap
- ansible-core ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1:2.16.19-1.el9ap
- python3.12-pulpcore ansible automation platform 2.6 3.49.63-2.el9ap
- python3.12-gitpython ansible automation platform 2.6 3.1.50-1.el9ap
- automation-platform-ui ansible automation platform 2.6 2.6.11-1.el9ap
- automation-gateway-proxy ansible automation platform 2.6 2.6.17-1.el9ap
red hat advisories RHSA-2026:42079RHSA-2026:42078RHSA-2026:36359RHSA-2026:36315RHSA-2026:36193RHSA-2026:34891
- python3 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 3.6.15-150300.10.129.1
- python3-core SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +12 more 3.6.15-150300.10.129.1
- grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
- mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1
- spacecmd Multi Linux Manager Tools SLE-15 5.2.10-150002.3.15.1
- uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.2.17-150002.3.20.1
- venv-salt-minion Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 3006.0-150002.5.22.1
- spacewalk-client-tools Multi Linux Manager Tools SLE-15 5.2.7-150002.3.12.1
suse advisories SUSE-SU-2026:4754-1SUSE-SU-2026:4585-1SUSE-SU-2026:4584-1SUSE-SU-2026:4583-1SUSE-SU-2026:4582-1SUSE-SU-2026:4581-1
- python-pip openSUSE Leap 16.0 25.0.1-160000.5.1
- python-pip openSUSE Tumbleweed 26.1.2-1.1
opensuse advisories openSUSE-SU-2026:20993-1openSUSE-SU-2026:10940-1
- python3.14-pip AlmaLinux 10 25.2-3.el10_2.5
- python3.14-pip-wheel AlmaLinux 10 25.2-3.el10_2.5
- python3.14-pip AlmaLinux 9 25.2-3.el9_8.5
- python3.14-pip-wheel AlmaLinux 9 25.2-3.el9_8.5
almalinux advisories ALSA-2026:36193ALSA-2026:36315
- python3.14-pip Rocky Linux 10 25.2-3.el10_2.5
- python3.14-pip Rocky Linux 9 25.2-3.el9_8.5
rocky linux advisories RLSA-2026:36193RLSA-2026:36315
- python-pip Azure Linux 3.0 24.2-9
- python-virtualenv Azure Linux 3.0 20.36.1-5
azure linux advisories AZL-89325AZL-89463
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/pypa/pip#14000 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-8643 updated cvss 8.0
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
-
Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9affected: workaround, no fix available
-
Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-rhel9-operator Red Hat AI Inference Server rhaii/vllm-cpu-rhel9, rhaii/vllm-tpu-rhel9, rhaii/vllm-cuda-rhel9, rhaii/vllm-rocm-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, +9 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/controller-rhel8, ansible-automation-platform-26/hub-rhel9-operator, ansible-automation-platform-26/gateway-rhel9-operator, ansible-automation-platform/automation-dashboard-rhel9, ansible-automation-platform-26/controller-rhel9-operator, ansible-automation-platform-26/lightspeed-rhel9-operator, +4 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Developer Hub 1 rhdh/rhdh-must-gather-rhel9affected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux 8 ubi8/python-36, ubi8/python-39, ubi8/python-312, rhel8/python-311 Red Hat Enterprise Linux 9 rhel9/python-39, ubi9/python-312, rhel9/python-311, ubi9/python-312-minimal Red Hat Enterprise Linux 10 rhel10/python-312-minimalaffected: workaround, no fix available
-
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/disk-image-cuda-rhel9, +2 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Enterprise Linux command line assistant rhel-cla/rhel-knowledge-bridge-rhel10 Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-cuda-rhel9, rhoai/odh-vllm-rocm-rhel9, rhai/base-image-gaudi-rhel9, rhai/base-image-rocm-7.1-rhel9, rhoai/odh-pipelines-components-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, +3 more Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift4/ose-ansible-rhel9-operator Red Hat Trusted Artifact Signer rhtas/segment-reporting-rhel9affected: workaround, no fix available
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/controller-rhel8 1784049109fixed: vendor fix RHSA-2026:42144
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower 4.6.30-2.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower 4.6.30-2.el9apfixed: vendor fix RHSA-2026:42078
show 18 moreshow fewer
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1782761510, ansible-automation-platform-26/controller-rhel9 1785753810, ansible-automation-platform-26/de-minimal-rhel9 1782711769, ansible-automation-platform-26/de-supported-rhel9 1782713671, ansible-automation-platform-tech-preview/metrics-service-rhel9 1783969139fixed: vendor fix RHSA-2026:50479
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-venv-tower 4.7.14-3.el9apfixed: vendor fix RHSA-2026:42079
-
Red Hat Discovery 2 discovery/discovery-server-rhel9 1782763840, discovery/discovery-server-rhel9 1786638573fixed: vendor fix RHSA-2026:54760
-
Red Hat Enterprise Linux AppStream (v. 9) python3.14-pip 25.2-3.el9_8.5, python3.14-pip-wheel 25.2-3.el9_8.5fixed: vendor fix RHSA-2026:36315
-
Red Hat Enterprise Linux AppStream (v. 10) python3.14-pip 25.2-3.el10_2.5, python3.14-pip-wheel 25.2-3.el10_2.5fixed: vendor fix RHSA-2026:36193
-
Red Hat Hardened Images python-pip 26.1.2-1.hum1, python3-pip 26.1.2-1.hum1, python-pip 26.1.1-3.1.hum1, python3-pip 26.1.1-3.1.hum1, python-pip-wheel 26.1.2-1.hum1, python-pip-wheel 26.1.1-3.1.hum1fixed: vendor fix RHSA-2026:34891
-
Red Hat Migration Toolkit for Applications 8.2 mta/mta-rhel9-operator 1786481481fixed: vendor fix RHSA-2026:56347
-
Red Hat OpenShift AI 2.25 rhoai/odh-caikit-nlp-rhel9 1791448212, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-built-in-detector-rhel9 1791364320, rhoai/odh-caikit-tgis-serving-rhel9 1783082430, rhoai/odh-modelmesh-runtime-adapter-rhel9 1783342900, rhoai/odh-kserve-storage-initializer-rhel9 1783024305, +4 morefixed: vendor fix RHSA-2026:87410
-
Red Hat OpenShift AI 3.0 rhai/base-image-cpu-rhel9 1782929133, rhai/base-image-cpu-rhel9 1793042072, rhai/base-image-tpu-rhel9 1782968171, rhai/base-image-cuda-rhel9 1782929069, rhai/base-image-cuda-rhel9 1793042067, rhai/base-image-rocm-rhel9 1782928977, +2 morefixed: vendor fix RHSA-2026:34772
-
Red Hat OpenShift AI 3.2 rhai/base-image-cpu-rhel9 1782915416, rhai/base-image-tpu-rhel9 1782914629, rhai/base-image-cuda-rhel9 1782915184, rhai/base-image-rocm-rhel9 1782914721, rhai/base-image-rocm-rhel9 1782914751, rhai/base-image-spyre-rhel9 1782914833fixed: vendor fix RHSA-2026:34739
-
Red Hat OpenShift AI 3.3 rhoai/odh-mlserver-rhel9 1782887848, rhai/base-image-cpu-rhel9 1782914779, rhai/base-image-tpu-rhel9 1782914653, rhai/base-image-spyre-rhel9 1782916020, rhai/base-image-neuron-rhel9 1782915056, rhai/base-image-rocm-6.4-rhel9 1782914644, +12 morefixed: vendor fix RHSA-2026:34776
-
Red Hat OpenShift AI 3.4 rhoai/odh-automl-rhel9 1786612415, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-mlserver-rhel9 1782726504, rhai/base-image-cpu-rhel9 1790703631, rhai/base-image-tpu-rhel9 1790703539, rhai/base-image-spyre-rhel9 1790703597, +39 morefixed: vendor fix RHSA-2026:74679
-
Red Hat OpenShift AI 3.5 rhoai/odh-latency-predictor-training-rhel9 1786552250, rhoai/odh-latency-predictor-prediction-rhel9 1786552271fixed: vendor fix RHSA-2026:60367
-
Red Hat OpenShift Dev Spaces 3.31 devspaces/udi-rhel9 1792708612fixed: vendor fix RHSA-2026:90321
-
Red Hat Trusted Artifact Signer 1.4 rhtas/model-transparency-rhel9 1782485441fixed: vendor fix RHSA-2026:37283
-
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operatornot affected: vulnerable code not in execute path
-
Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9not affected: component not present
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1784050598, ansible-automation-platform-25/gateway-rhel8 1784049566, ansible-automation-platform-25/hub-web-rhel8 1784054665, ansible-automation-platform-25/receptor-rhel8 1784047883, ansible-automation-platform-25/de-minimal-rhel8 1784064978, ansible-automation-platform-25/ee-minimal-rhel8 1784035663, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.6-1.el8ap, receptorctl 1.6.6-1.el8ap, ansible-core 2.16.19-1.el8ap, ansible-test 2.16.19-1.el8ap, automation-hub 4.10.16-1.el8ap, python3.12-pyjwt 2.13.0-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.6-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-core 2.16.19-1.el9ap, ansible-test 2.16.19-1.el9ap, automation-hub 4.10.16-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, +20 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1782755272, ansible-automation-platform-26/hub-rhel9 1783979593, ansible-automation-platform-26/hub-rhel9 1785753568, ansible-automation-platform-26/gateway-rhel9 1783969842, ansible-automation-platform-26/gateway-rhel9 1785780020, ansible-automation-platform-26/hub-web-rhel9 1782759318, +82 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.6-1.el9ap, molecule 26.6.0-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-sign 0.1.6-1.el9ap, ansible-lint 26.6.0-1.el9ap, ansible-core 2.16.19-1.el9ap, +39 morenot affected: vulnerable code not present
18 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.1 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CISA ADP | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 4.1 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pip | <26.1.2 |
26.1.2 |
Affected products
- Python Packaging Authority pip
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Ansible Automation Platform 2.5
- Red Hat Red Hat Ansible Automation Platform 2.6
- Red Hat Red Hat Discovery 2
- Red Hat Red Hat Hardened Images
- Red Hat Red Hat Migration Toolkit for Applications 8.2
- Red Hat Red Hat OpenShift AI 2.25
- Red Hat Red Hat OpenShift AI 3.0
- Red Hat Red Hat OpenShift AI 3.2
- Red Hat Red Hat OpenShift AI 3.3
- Red Hat Red Hat OpenShift AI 3.4
- Red Hat Red Hat Trusted Artifact Signer 1.4
- Red Hat Exploit Intelligence
- Red Hat Lightspeed Core
- Red Hat Migration Toolkit for Virtualization
- Red Hat OpenShift Lightspeed
- Red Hat OpenShift Service Mesh 3
- Red Hat Pen Drive Powered by Red Hat Lightspeed
- Red Hat Red Hat AI Inference Server
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Developer Hub
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Red Hat Enterprise Linux command line assistant
- Red Hat Red Hat OpenShift AI (RHOAI)
- Red Hat Red Hat OpenShift Container Platform 4
- Red Hat Red Hat OpenShift Dev Spaces
- Red Hat Red Hat Quay 3
- Red Hat Red Hat Satellite 6
- Red Hat Red Hat Trusted Artifact Signer
- Red Hat Service Telemetry Framework 1.5
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/pypa/pip/pull/14000
patch, web, issue-tracking
-
mail.python.org
/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/
vendor-advisory, mailing-list, advisory
-
access.redhat.com
/errata/RHSA-2026:42078
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:42079
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36193
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:36315
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:42144
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:50479
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:34374
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:42132
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54760
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:33313
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34891
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:56347
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:42644
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:34772
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34778
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34780
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34773
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34774
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34739
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34752
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34765
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34758
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34756
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34760
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34776
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34748
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34775
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34740
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34749
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34750
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34741
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34777
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:37275
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60520
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:34456
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:37283
vendor-advisory, web
-
openwall.com
/lists/oss-security/2026/06/01/5
web, mailing-list, third-party-advisory, advisory
-
access.redhat.com
/security/cve/CVE-2026-8643
vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-8643
advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2460927
web
-
github.com
/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml
web
-
github.com
/pypa/pip
package
-
mail.python.org
/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ
web
-
security.access.redhat.com
/data/csaf/v2/vex/2026/cve-2026-8643.json
web
-
github.com
/advisories/GHSA-wf93-45jw-7689
advisory
Sources
- CVE List CVE-2026-8643
- GitHub Advisory GHSA-wf93-45jw-7689
- NVD CVE-2026-8643
- OSV PYSEC-2026-196
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.