pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the
    resolved absolute path to the installation directory, leading to entry points being installed outside the
    installation directory. (CVE-2026-8643)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36193 advisory.

    * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36315 advisory.

    * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36315 advisory.

    [25.2-5]
    - Fix gating plan
    - removed unnecessary older VERSION= tests
    - removed bootstrap test
    - fix pip_install_upgrade to run pip-3.14
    - fix bash completion + remove unused metadata file

    [25.2-4]
    - Security fix for CVE-2026-8643: path traversal in wheel entry points

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36193 advisory.

    * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36315 advisory.

    * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36315 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite (CVE-2026-8643)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36193 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite (CVE-2026-8643)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2634-1 advisory.

    This update for python-pip fixes the following issues

    - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
    - CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation       (bsc#1263442).
    - CVE-2026-8643: path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite       (bsc#1266669).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1840 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1839 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1838 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1841 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1837 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3358 advisory.

    A flaw was found in pip, the package installer for Python. A remote attacker can exploit this     vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially     crafted entry-point names that use directory traversal or absolute paths. This allows pip to write     generated script wrappers outside the intended installation directory, leading to arbitrary file     overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead     to arbitrary code execution. (CVE-2026-8643)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0422 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-8643:
    python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file     overwrite

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the     resolved absolute path to the installation directory, leading to entry points being installed outside the     installation directory. (CVE-2026-8643)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
444547	SCA: security update for pip (GHSA-wf93-45jw-7689)	Tenable Cloud Security	SCA Checks	medium
444547	SCA: security update for pip (GHSA-wf93-45jw-7689)	Tenable Self-Hosted Container Security	SCA Checks	medium
325761	AlmaLinux 10 : python3.14-pip (ALSA-2026:36193)	Nessus	Alma Linux Local Security Checks	medium
325746	AlmaLinux 9 : python3.14-pip (ALSA-2026:36315)	Nessus	Alma Linux Local Security Checks	medium
325727	Oracle Linux 9 : python3.14-pip (ELSA-2026-36315)	Nessus	Oracle Linux Local Security Checks	medium
325660	RockyLinux 10 : python3.14-pip (RLSA-2026:36193)	Nessus	Rocky Linux Local Security Checks	medium
325659	RockyLinux 9 : python3.14-pip (RLSA-2026:36315)	Nessus	Rocky Linux Local Security Checks	medium
325486	RHEL 9 : python3.14-pip (RHSA-2026:36315)	Nessus	Red Hat Local Security Checks	medium
325462	RHEL 10 : python3.14-pip (RHSA-2026:36193)	Nessus	Red Hat Local Security Checks	medium
323042	SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2026:2634-1)	Nessus	SuSE Local Security Checks	medium
322089	Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-1840)	Nessus	Amazon Linux Local Security Checks	medium
322045	Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-1839)	Nessus	Amazon Linux Local Security Checks	medium
322039	Amazon Linux 2023 : python3.14-pip, python3.14-pip-wheel (ALAS2023-2026-1838)	Nessus	Amazon Linux Local Security Checks	medium
322001	Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-1841)	Nessus	Amazon Linux Local Security Checks	medium
321996	Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-1837)	Nessus	Amazon Linux Local Security Checks	medium
321994	Amazon Linux 2 : python-pip, --advisory ALAS2-2026-3358 (ALAS-2026-3358)	Nessus	Amazon Linux Local Security Checks	medium
319740	TencentOS Server 4: python-pip (TSSA-2026:0422)	Nessus	Tencent Local Security Checks	medium
317532	Linux Distros Unpatched Vulnerability : CVE-2026-8643	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-8643

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium