CVE-2021-3572: Improper Input Validation in pip
Summary
CVE-2021-3572: Improper Input Validation in pip. Affects pip versions < 21.1. Fixed in 21.1. How to fix ↓
Also tracked for
- pip · Bitnami
- python-pip · Debian:11
The same CVE-2021-3572 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'pip' package is a package management system used to install and manage software packages written in Python. It is a widely used tool in the Python ecosystem and is responsible for resolving dependencies and installing packages from the Python Package Index (PyPI). This vulnerability affects versions of 'pip' prior to version 21.1.
Vulnerability Detail
The vulnerability identified as CVE-2021-3572 is an improper input validation issue in 'pip'. It arises from the mishandling of Unicode separators in git references. An attacker with remote access could exploit this flaw to potentially install a different revision on a repository. The primary concern with this vulnerability is the potential impact on data integrity. The vulnerability has been assigned a CVSS score of 5.7.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.1
This is the first release that contains the fix.
pip install --upgrade "pip==21.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability CVE-2021-3572 in the 'pip' package could allow an attacker to install a different revision on a repository, potentially compromising data integrity. It is recommended to update to version 21.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
The vulnerability could allow an attacker to install a different revision on a repository, potentially compromising data integrity.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed version of 'pip'.
No, only versions prior to 21.1 are affected by this vulnerability. Updating to version 21.1 or later resolves the issue.
The vulnerability is classified as moderate, with a CVSS score of 5.7. While it poses a potential risk to data integrity, it does not have the highest severity level.
You can find more information about this vulnerability in the GitHub Security Advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-5xp3-jfq3-5q8x/GHSA-5xp3-jfq3-5q8x.json
References
Related vulnerabilities
Recent vulnerabilities recorded for pip.
