Critical Path Traversal Vulnerability in python3.14-pip Package
Summary
RLSA-2026:36315: Important: python3.14-pip security update. Affects python3.14-pip versions < 0:25.2-3.el9_8.5. Fixed in 0:25.2-3.el9_8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python3.14-pip is a package manager for Python that allows users to install and manage additional libraries and dependencies that are not part of the standard Python library. It is widely used in various applications for managing Python packages efficiently. However, it has been identified to have a security vulnerability that can lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2026-8643, is a path traversal issue that arises from a malicious entry point name during the installation of pip wheels. This flaw allows an attacker to overwrite arbitrary files on the system, potentially compromising the integrity and security of the application. The implications of this vulnerability are significant, as it can lead to unauthorized access and manipulation of critical system files.
How To Fix
Minimum fixed version
0:25.2-3.el9_8.5
This is the first release that contains the fix.
sudo dnf update python3.14-pipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using pip to install packages from untrusted sources until the package is updated. Additionally, ensure that any entry point names used in pip installations are sanitized to prevent path traversal attacks.
Conclusion
The python3.14-pip package has a critical vulnerability that can lead to severe security risks. It is crucial to update to the latest patched version to protect your systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.14-pip →
FAQ
CVE-2026-8643 is a security vulnerability in the python3.14-pip package that allows for path traversal, enabling attackers to overwrite arbitrary files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploiting this vulnerability can lead to unauthorized file overwrites, potentially compromising system integrity and allowing attackers to execute malicious code.
Yes, a patch is available. Update to version 0:25.2-3.el9_8.5 or later to mitigate the vulnerability.
If an immediate update is not possible, avoid installing packages from untrusted sources and sanitize entry point names used in pip installations.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-pip.
