CVE-2013-1888: Improper Link Resolution Before File Access in pip
Summary
CVE-2013-1888: Improper Link Resolution Before File Access in pip. Affects pip versions < 1.3. Fixed in 1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pip is a package management system used to install and manage software packages written in Python. It is the standard package manager for Python and is widely used in the Python community. This vulnerability affects versions of pip before 1.3. The vulnerability allows local users to overwrite arbitrary files by exploiting a symlink attack on a file in the /tmp/pip-build temporary directory.
Vulnerability Detail
The vulnerability arises from improper link resolution before file access in pip. By creating a symbolic link to a file in the /tmp/pip-build temporary directory, an attacker with local access can trick pip into overwriting arbitrary files. This can lead to unauthorized modification or destruction of important files, potentially causing system instability or compromising the integrity of the affected system.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3
This is the first release that contains the fix.
pip install --upgrade "pip==1.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of pip to mitigate the risk.
Conclusion
In conclusion, the vulnerability in pip before version 1.3 allows local users to overwrite arbitrary files through a symlink attack. To mitigate this risk, it is crucial to upgrade to the fixed version of pip. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
pip is a package management system used to install and manage software packages written in Python.
A symlink attack, also known as a symbolic link attack, is a type of security vulnerability where an attacker creates a symbolic link to a file or directory in order to trick a program into accessing or modifying unintended files or directories.
The /tmp/pip-build temporary directory is a directory used by pip for building and installing packages. It is vulnerable to symlink attacks in versions of pip before 1.3.
The vulnerability allows local users to overwrite arbitrary files, which can lead to unauthorized modification or destruction of important files. This can potentially cause system instability or compromise the integrity of the affected system.
To upgrade pip to the fixed version (1.3 or later), you can use the command 'pip install --upgrade pip'.
References
Related vulnerabilities
Recent vulnerabilities recorded for pip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
