Vulnerability in pip: Lack of Randomness in Build Directory
Summary
CVE-2014-8991: pip lack of randomness in build directory. Affects pip versions >= 1.3, < 6.0. Fixed in 6.0. How to fix ↓
Also tracked for
- python-pip · Debian:11
The same CVE-2014-8991 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pip is a package management system used to install and manage software packages written in Python. It is the standard package manager for Python and is widely used in the Python ecosystem. The vulnerability in pip arises from a lack of randomness in the build directory. This vulnerability affects pip versions 1.3 through 1.5.6. When a local user creates a /tmp/pip-build-* file for another user, it can cause a denial of service by preventing package installation.
Vulnerability Detail
The vulnerability in pip is due to the lack of randomness in the build directory. This allows a local user to create a file in the build directory that is intended for another user. By doing so, the local user can prevent the installation of packages, leading to a denial of service. This vulnerability has a low severity rating and was assigned the identifier CVE-2014-8991. It was published on May 13, 2022, and last modified on October 19, 2023.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0
This is the first release that contains the fix.
pip install --upgrade "pip==6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in pip arises from a lack of randomness in the build directory. This can be exploited by local users to prevent the installation of packages, leading to a denial of service. To fix this vulnerability, users should upgrade to pip version 6.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
pip is a package management system used to install and manage software packages written in Python.
This vulnerability affects pip versions 1.3 through 1.5.6.
The impact of this vulnerability is a denial of service, as it prevents the installation of packages.
This vulnerability has a low severity rating.
Yes, users should upgrade to pip version 6.0 or later to fix this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for pip.
