Detections
Analytics

SCA: security update for pip (GHSA-4xh5-x5gv-qwph)

medium Tenable Self-Hosted Container Security Plugin ID 435429

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - When extracting a tar archive pip may not check symbolic links point into the extraction directory if the
 tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this
 vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that
 implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction
 for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in
 the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use
 the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix,
 upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),
 applying the linked patch, or inspecting source distributions (sdists) before installation as is already a
 best-practice. (CVE-2025-8869)

See Also

https://github.com/advisories/GHSA-4xh5-x5gv-qwph

Plugin Details

Severity: Medium

ID: 435429

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 9/25/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.76

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C

CVSS Score Source: CVE-2025-8869

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.9

Threat Score: 2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/24/2025

Vulnerability Publication Date: 9/24/2025

Reference Information

CVE: CVE-2025-8869

cwe: CWE-59