CVE-2026-8643: pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

(updated )

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

References

Code Behaviors & Features

Detect and mitigate CVE-2026-8643 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →