CVE-2026-1703

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "PSF",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1703.json"
}

References

Affected packages

Git / github.com/pypa/pip

Affected ranges

Type: GIT
Repo: https://github.com/pypa/pip
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2f4d4a836ed00076001376fbb0ce6dc4f22cdae2

Affected versions

0.*

0.3

0.6

0.7

0.7.1

0.8

0.8.2

0.8.3

1.*

1.0

1.2

1.4rc1

1.4rc2

10.*

10.0.0

10.0.1

18.*

18.0

18.1

19.*

19.0

19.0.2

19.1.1

20.*

20.0.2

21.*

21.0

21.3

6.*

6.0

9.*

9.0.0

9.0.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-1703.json"