Description (CNA)
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Python Packaging Authority / pip | affected 0 before 26.2 |
CWE
CWE-36
References
- https://github.com/pypa/pip/pull/14110
- https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.