Low 2.0Published Feb 2, 2026

CVE-2026-1703Limited path traversal when installing wheel archives

Updated under an hour ago (Oct 27, 2026, 12:50 PM ET)

Does this affect you?

It affects Python Packaging Authority pip. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Packaging Authority pip

Exploited in the last 30 days

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

CVSS: 2.0 LOW (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Deferred
Record last updated: Feb 2, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Packaging Authority pip python_packaging_authority:pip (from the name)	before 26.0	CNA record

References

References

https://github.com/pypa/pip/pull/13777	patch
https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735	patch
https://mail.python.org/archives/list/security-announce@python.org/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ/	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.