CVE-2013-1888: Vulnerability in pip Package
Summary
CVE-2013-1888: pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory. Affects pip versions < 1.3. Fixed in 1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pip package is a package management system used to install and manage software packages written in Python. It is a widely used tool in the Python ecosystem and is responsible for resolving dependencies and installing packages from the Python Package Index (PyPI). However, prior to version 1.3, pip was susceptible to a symlink attack on files in the temporary directory (/tmp/pip-build), allowing local users to overwrite arbitrary files.
Vulnerability Detail
The vulnerability (CVE-2013-1888) in pip before version 1.3 allowed local users to exploit a symlink attack on files in the /tmp/pip-build temporary directory. By creating a symbolic link to a file in the temporary directory, an attacker could overwrite arbitrary files, potentially leading to unauthorized access, data corruption, or privilege escalation. This vulnerability posed a significant security risk to systems using pip versions prior to 1.3.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3
This is the first release that contains the fix.
pip install --upgrade "pip==1.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the /tmp/pip-build directory is properly secured and not accessible by unauthorized users. Additionally, regular system updates and patching can help protect against potential symlink attacks.
Conclusion
The vulnerability in pip versions prior to 1.3 allowed local users to exploit a symlink attack on files in the /tmp/pip-build temporary directory. To mitigate this vulnerability, it is recommended to upgrade pip to version 1.3 or later. Regular system updates and securing the /tmp/pip-build directory can also help protect against potential symlink attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
The vulnerability allows local users to overwrite arbitrary files, which can lead to unauthorized access, data corruption, or privilege escalation.
Versions of pip prior to 1.3 are affected by this vulnerability.
No, this vulnerability can only be exploited by local users with access to the system.
There is no known public exploit for this vulnerability at the time of this report.
There are no reported incidents related to this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for pip.
