# CVE-2026-8643

## Summary

- **CVE ID:** CVE-2026-8643
- **Severity:** MEDIUM
- **CVSS Score:** 8 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N)
- **CWE:** N/A
- **Published:** Jun 1, 2026
- **Last Modified:** Sep 16, 2026

## Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

## Affected Products

- Python Packaging Authority — pip (0)
- Python Packaging Authority — pip (24.0)

## References

- [CNA](https://github.com/pypa/pip/pull/14000)
- [CNA](https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/)
- [CVE](http://www.openwall.com/lists/oss-security/2026/06/01/5)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-8643)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2460927)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33313)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34374)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34772)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34778)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34780)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34774)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34752)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34765)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34758)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34756)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34760)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34775)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34749)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34741)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34456)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34891)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34773)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34739)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34776)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34748)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34740)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34750)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34777)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36193)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36315)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37275)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37283)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42078)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42079)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42144)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42132)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42644)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:50479)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54760)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56347)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60520)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.32%
- **EPSS Percentile:** 25.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._