GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

BREW-AZURE-CLI-CVE-2026-8643 (GHSA-WF93-45JW-7689)

Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-09-09 23:43 – Source website
VLAI
Summary
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
Details

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Severity
8.0 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
4.1 (Medium)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
https://nvd.nist.gov/vuln/detail/CVE-2026-8643 ADVISORY
https://github.com/pypa/pip/pull/14000 WEB
https://access.redhat.com/errata/RHSA-2026:33313 WEB
https://access.redhat.com/errata/RHSA-2026:34776 WEB
https://access.redhat.com/errata/RHSA-2026:34777 WEB
https://access.redhat.com/errata/RHSA-2026:34778 WEB
https://access.redhat.com/errata/RHSA-2026:34780 WEB
https://access.redhat.com/errata/RHSA-2026:34891 WEB
https://access.redhat.com/errata/RHSA-2026:36193 WEB
https://access.redhat.com/errata/RHSA-2026:36315 WEB
https://access.redhat.com/errata/RHSA-2026:37275 WEB
https://access.redhat.com/errata/RHSA-2026:37283 WEB
https://access.redhat.com/security/cve/CVE-2026-8643 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2460927 WEB
https://github.com/pypa/advisory-database/tree/ma… WEB
https://github.com/pypa/pip PACKAGE
https://mail.python.org/archives/list/security-an… WEB
https://security.access.redhat.com/data/csaf/v2/v… WEB
https://access.redhat.com/errata/RHSA-2026:34374 WEB
https://access.redhat.com/errata/RHSA-2026:34456 WEB
https://access.redhat.com/errata/RHSA-2026:34739 WEB
https://access.redhat.com/errata/RHSA-2026:34740 WEB
https://access.redhat.com/errata/RHSA-2026:34741 WEB
https://access.redhat.com/errata/RHSA-2026:34748 WEB
https://access.redhat.com/errata/RHSA-2026:34749 WEB
https://access.redhat.com/errata/RHSA-2026:34750 WEB
https://access.redhat.com/errata/RHSA-2026:34752 WEB
https://access.redhat.com/errata/RHSA-2026:34756 WEB
https://access.redhat.com/errata/RHSA-2026:34758 WEB
https://access.redhat.com/errata/RHSA-2026:34760 WEB
https://access.redhat.com/errata/RHSA-2026:34765 WEB
https://access.redhat.com/errata/RHSA-2026:34772 WEB
https://access.redhat.com/errata/RHSA-2026:34773 WEB
https://access.redhat.com/errata/RHSA-2026:34774 WEB
https://access.redhat.com/errata/RHSA-2026:34775 WEB
http://www.openwall.com/lists/oss-security/2026/06/01/5 WEB
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "pip",
        "resource_purl": "pkg:pypi/pip@26.2.1",
        "upstream_fixed_in": "26.1.2"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "azure-cli",
        "purl": "pkg:brew/azure-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.89.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/pip@26.2.1",
        "name": "pip",
        "resource": "pip",
        "strategy": "registry",
        "subject_version": "26.2.1"
      }
    ]
  },
  "details": "pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.",
  "id": "BREW-azure-cli-CVE-2026-8643",
  "modified": "2026-09-09T23:43:05Z",
  "published": "2026-08-13T16:37:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/pip/pull/14000"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:33313"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34776"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34777"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34778"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34780"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34891"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36193"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36315"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:37275"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:37283"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-8643"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/pip"
    },
    {
      "type": "WEB",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34374"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34456"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34739"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34740"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34741"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34748"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34749"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34750"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34752"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34756"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34758"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34760"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34765"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34772"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34773"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34774"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34775"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/06/01/5"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": " pip: Path traversal in console_scripts/gui_scripts\u00a0entry point names allows installing scripts outside of target directory",
  "upstream": [
    "GHSA-wf93-45jw-7689",
    "CVE-2026-8643",
    "PYSEC-2026-196"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.