CVE-2013-1629: Vulnerability in pip Package
Summary
CVE-2013-1629: pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response... Affects pip versions < 1.3. Fixed in 1.3. How to fix ↓
Also tracked for
- python-pip · Debian:11
The same CVE-2013-1629 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pip package is a package management system used to install and manage software packages written in Python. It retrieves packages from the PyPI repository and installs them on the user's system. The vulnerability in pip version before 1.3 arises from its use of HTTP to retrieve packages from PyPI without performing integrity checks on package contents. This allows attackers to execute arbitrary code by crafting a malicious response to a 'pip install' operation.
Vulnerability Detail
The vulnerability in pip version before 1.3 allows man-in-the-middle attackers to execute arbitrary code on a user's system. By intercepting the HTTP response during a 'pip install' operation, an attacker can modify the package contents and inject malicious code. When the user installs the package, the malicious code gets executed, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3
This is the first release that contains the fix.
pip install --upgrade "pip==1.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in pip version before 1.3 allows attackers to execute arbitrary code on a user's system. To mitigate this risk, it is essential to upgrade to pip version 1.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
The vulnerability allows attackers to execute arbitrary code on a user's system, potentially leading to unauthorized access, data breaches, or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock to identify and alert you in real-time for open-source vulnerabilities, including this one.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of pip to mitigate the risk.
Yes, you can manually verify the integrity of downloaded packages by comparing their checksums with the ones provided by the package maintainers. However, upgrading to the latest version of pip is the recommended solution.
There have been reported instances of this vulnerability being exploited in the wild. It is crucial to update to the latest version of pip to protect your system.
Related vulnerabilities
Recent vulnerabilities recorded for pip.
