pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1840 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1839 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1838 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1841 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1837 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3358 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0422 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-8643:
    python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file     overwrite

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the     resolved absolute path to the installation directory, leading to entry points being installed outside the     installation directory. (CVE-2026-8643)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322089	Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-1840)	Nessus	Amazon Linux Local Security Checks	medium
322045	Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-1839)	Nessus	Amazon Linux Local Security Checks	medium
322039	Amazon Linux 2023 : python3.14-pip, python3.14-pip-wheel (ALAS2023-2026-1838)	Nessus	Amazon Linux Local Security Checks	medium
322001	Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-1841)	Nessus	Amazon Linux Local Security Checks	medium
321996	Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-1837)	Nessus	Amazon Linux Local Security Checks	medium
321994	Amazon Linux 2 : python-pip, --advisory ALAS2-2026-3358 (ALAS-2026-3358)	Nessus	Amazon Linux Local Security Checks	medium
319740	TencentOS Server 4: python-pip (TSSA-2026:0422)	Nessus	Tencent Local Security Checks	medium
317532	Linux Distros Unpatched Vulnerability : CVE-2026-8643	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-8643

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium