Python Packaging Authority pip

• CVE-2026-13346 Medium 5.6 pip absolute path traversal during download from malicious package indexes 0.3%
• CVE-2026-8643 High 8.0 pip can extract console_scripts and gui_scripts outside installation directory 0.3%
• CVE-2026-3219 Medium 4.6 pip doesn't reject concatenated ZIP and tar archives 0.1%
• CVE-2026-1703 Low 2.0 Limited path traversal when installing wheel archives 0.4%
• CVE-2025-8869 Medium 5.9 Fallback tar extraction in pip doesn't check symbolic links point to extraction directory 0.5%