CVE-2026-8643

MediumCVSS 5.5/10Last modified Sep 16, 2026

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2026
Last modified
Sep 16, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-864307.5league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link laCVE-2026-864317.2league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExteCVE-2026-864325.3commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentatiCVE-2026-864337.5commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::CVE-2026-864347.5league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalCVE-2026-864357.5commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate foCVE-2026-864365.4Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts CVE-2026-864377.2Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowiCVE-2026-864387.2Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrCVE-2026-864398.8knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delCVE-2026-86449.1IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.CVE-2026-864405.4Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stor
CVE-2026-8643: Medium severity, CVSS 5.5 | Vulnix