StackRadar

CVE-2026-8643

High

Advisory

Published 1 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.0
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,275
of 17,790 indexed, latest versions
Container images
1,223
deployed by those charts
Fix available
1 of 2
affected packages

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

Carried by container images the latest versions of 1,275 of 17,790 indexed charts deploy, on 1,223 images.

Affected packageAffected versionsFixed inImages
pippypi1.5.4, 8.1.1, 8.1.2, 9.0.0+67 more26.1.21,217
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 moreno fix listed139
OSV records
GHSA-wf93-45jw-7689UBUNTU-CVE-2026-8643DEBIAN-CVE-2026-8643
Also known as
PYSEC-2026-196

Charts affected

1,275 by stars
ChartLatestAffected imagesRadar Score
pagespages-blackburn1.0.01 of 3See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-botes1.0.01 of 3See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-brian1.0.01 of 3See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-buckll1.0.01 of 3See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-camden1.0.01 of 3See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-camden7711.0.01 of 3See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-diarmuidkeane1.0.01 of 3See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-draco1.0.01 of 3See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-ellora1.0.01 of 3See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-finchley1.0.01 of 3See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-fornax1.0.01 of 3See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-harsh1.0.01 of 3See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespagesk1.0.01 of 3See more

pages pagesk 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-microservice-ashim1.0.01 of 3See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-mihai1.0.01 of 3See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-nivesh1.0.01 of 3See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespagessandeepgudu1.0.01 of 3See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-shubhanker1.0.01 of 3See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-ssharma09091.0.01 of 3See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-sucharitha1.0.01 of 3See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-sudhir1.0.01 of 3See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-sushi1.0.01 of 3See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-vasanth58141.0.01 of 3See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pagespages-vjp1.0.01 of 3See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
ctfdpascaliskeVerified publisher2.0.01 of 1See more

ctfd pascaliske 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
pip@24.0
26.1.2

Open the chart page →

2,383
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
pip@25.3
26.1.2

Open the chart page →

4,788
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
pip@25.2
26.1.2

Open the chart page →

3,866
pagespawan-pages1.0.01 of 3See more

pages pawan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
stk-fluent-bit-loki-s3paxtecnologia0.2.11See more

stk-fluent-bit-loki-s3 paxtecnologia 0.2.1

1 container image this version deploys carries CVE-2026-8643.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
pip@25.3
26.1.2

Open the chart page →

—
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
pip@9.0.3
26.1.2

Open the chart page →

15,466
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
pip@9.0.3
26.1.2

Open the chart page →

15,466
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
pip@23.0.1
python-pip@23.0.1+dfsg-1
26.1.2
no fix listed

Open the chart page →

5,731
falcon-asgi-serverphanVerified publisher0.1.01 of 1See more

falcon-asgi-server phan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
phan2410/falcon-asgi-server:0.1.04a86d138832d
pip@25.0.1
26.1.2

Open the chart page →

8,215
email-managerphntom0.1.221 of 2See more

email-manager phntom 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
phntom/email-manager:0.1.22d8e2a9f2f085
pip@22.3.1
26.1.2

Open the chart page →

2,565
external-dns-host-networkphntom0.0.121 of 1See more

external-dns-host-network phntom 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
phntom/external-dns-host-network:0.0.123adadbac8443
pip@22.0.4
26.1.2

Open the chart page →

4,644
npre-essentialsphntom0.1.601 of 22See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:1.21.0710e23b489c5
pip@22.3.1
26.1.2

Open the chart page →

26,840
postgresql-backupphntom0.1.91 of 1See more

postgresql-backup phntom 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
phntom/postgresql-backup-s3:1.0.2249b6488f618b
pip@22.3.1
26.1.2

Open the chart page →

2,556
stocks-nasdaq-crawlerphntom0.0.361 of 1See more

stocks-nasdaq-crawler phntom 0.0.36

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
phntom/stocks-nasdaq-crawler:0.0.28d2b844700b57
pip@20.2.3
26.1.2

Open the chart page →

1,845
phronetisphronetis0.1.272 of 2See more

phronetis phronetis 0.1.27

2 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.1
26.1.2
no fix listed
knspar/phronetis-operator:0.1.60c4f0543ee58
pip@24.0
26.1.2

Open the chart page →

15,077
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
pip@20.0.2
python-pip@20.0.2-5ubuntu1.6
26.1.2
no fix listed

Open the chart page →

22,146
pieeatpieeatOfficialVerified publisher0.9.31 of 1See more

pieeat pieeat 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
quay.io/maxiv/pieeat:0.9.3099715479210
pip@26.0.1
26.1.2

Open the chart page →

1,413
pagespighosh-pages1.0.01 of 3See more

pages pighosh-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,233
pingdom-operatorpingdom-operator0.0.201 of 1See more

pingdom-operator pingdom-operator 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
pip@24.0
26.1.2

Open the chart page →

11,017
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
alpine/k8s:1.30.2cd560fce90f7
pip@24.1.1
26.1.2

Open the chart page →

25,626
playlist-mirrorplaylist-mirrorVerified publisher1.0.31 of 1See more

playlist-mirror playlist-mirror 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/itobey/playlist-mirror:1.0.0601082677a46
pip@25.0.1
26.1.2

Open the chart page →

1,033
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
pip@9.0.3
26.1.2

Open the chart page →

11,153
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
pip@23.1.2
26.1.2

Open the chart page →

12,754
pod-birdspod-birds0.1.01 of 1See more

pod-birds pod-birds 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
teknas09/bird-pod:latest12a1fa85c4aa
pip@24.0
26.1.2

Open the chart page →

11,680
libretimepodzone-chartsVerified publisher0.4.14 of 9See more

libretime podzone-charts 0.4.1

4 of the 9 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/libretime/libretime-analyzer:latest3d5e236216ad
pip@23.0.1
26.1.2
ghcr.io/libretime/libretime-api:latesteae026cc8909
pip@23.0.1
26.1.2
ghcr.io/libretime/libretime-playout:latest71a8706531aa
pip@23.0.1
26.1.2
ghcr.io/libretime/libretime-worker:latestd39ff5272b2e
pip@23.0.1
26.1.2

Open the chart page →

11,181
port-agentport-labsVerified publisher0.8.161 of 1See more

port-agent port-labs 0.8.16

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/port-labs/port-agent:v0.8.12c92d1e223f5c
pip@26.0.1
26.1.2

Open the chart page →

721

Container images carrying it

1,223 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/aws-exporters/prometheus-ecr-exporter:0.1.442b0c87470d6
pip@20.3.4
26.1.2
1
ghcr.io/aws-exporters/prometheus-inspector-exporter:0.0.29c7c11293b3c
pip@20.3.4
26.1.2
1
ghcr.io/axoflow/axosyslog:4.5.0aa7831e207cd
pip@23.3.1
26.1.2
1
ghcr.io/bensoer/external-secrets-reloader:v0.1.38e31b5a81853
pip@24.0
26.1.2
1
ghcr.io/bensoer/sibyl:v0.2.06dca4455fde3
pip@24.0
26.1.2
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
pip@25.2
26.1.2
1
ghcr.io/b-it-projects-gmbh/nvme_exporter:lateste70307b193c6
pip@23.0.1
26.1.2
1
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
pip@24.2
26.1.2
1
ghcr.io/blakeblackshear/frigate:0.13.07a5244e4c8dc
pip@20.3.4
26.1.2
1
ghcr.io/blakeblackshear/frigate:0.12.0c862771e38e8
pip@20.3.4
26.1.2
1
ghcr.io/borgmatic-collective/borgmatic:1.9.9835b72878606
pip@25.0
26.1.2
1
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.3
26.1.2
no fix listed
1
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.3
26.1.2
no fix listed
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.3
26.1.2
no fix listed
1
ghcr.io/caas-team/py-kube-downscaler:26.4.0af05a098b0d2
pip@25.0.1
26.1.2
1
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
pip@24.3.1
26.1.2
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
pip@24.3.1
26.1.2
1
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
pip@25.0.1
26.1.2
1
ghcr.io/cjmalloy/jasper:v1.3.282726a947bb65b
pip@23.0.1
python-pip@23.0.1+dfsg-1
26.1.2
no fix listed
1
ghcr.io/cloudnative-pg/postgresql:18899d3ed526b6
pip@20.3.4
26.1.2
1
ghcr.io/cloudnative-pg/postgresql:14.5b3b30d04b362
pip@20.3.4
26.1.2
1
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
pip@24.3.1
26.1.2
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
pip@23.0.1
26.1.2
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
pip@24.2
26.1.2
1
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
pip@24.0
26.1.2
1
ghcr.io/cunningpike/fediblockhole:0.4.22abc5f0350dc
pip@22.3.1
26.1.2
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
pip@24.3.1
26.1.2
1
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latestf9f34c8ed688
pip@25.0.1
26.1.2
1
ghcr.io/dask/dask:2024.1.0080150de7d86
pip@23.2.1
26.1.2
1
ghcr.io/dask/dask-gateway-server:2024.1.0881e7acfc5a0
pip@23.2.1
26.1.2
1
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
pip@25.2
26.1.2
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
pip@25.0.1
26.1.2
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
pip@23.3.2
26.1.2
1
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
pip@25.1.1
26.1.2
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
pip@23.0.1
26.1.2
1
ghcr.io/dgtlmoon/changedetection.io:0.60.47bb6963b730d
pip@24.0
26.1.2
1
ghcr.io/dgtlmoon/changedetection.io:0.60.6eb4a9f718801
pip@24.0
26.1.2
1
ghcr.io/dgtlmoon/changedetection.io:0.60.3:latestecacd9fd0c66
pip@24.0
26.1.2
1
ghcr.io/dgtlmoon/changedetection.io:0.39.4f1ce4c56ccaa
pip@21.2.4
26.1.2
1
ghcr.io/djerfy/zabbix-kubernetes-discovery:v1.4.207a50c07e7c69
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.1
26.1.2
no fix listed
1
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
pip@25.3
26.1.2
1
ghcr.io/dodevops/azure-advanced-backup:0.4.01041d4449e49
pip@22.0.4
26.1.2
1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
pip@21.2.4
26.1.2
1
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
pip@23.2.1
26.1.2
1
ghcr.io/dynamia-ai/hami-enterprise:v2.10.0-r0-openshift.c4e22e88745504757300
pip@9.0.3
26.1.2
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
pip@24.0
26.1.2
1
ghcr.io/emissary-ingress/emissary:4.1.04a981156abee
pip@26.1.1
26.1.2
1
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
pip@25.0.1
26.1.2
1
ghcr.io/eshepelyuk/dckr/cmak2zk:1.2.022de6314c31e
pip@21.2.4
26.1.2
1
ghcr.io/eslupmi/impulse:v3.7.03ded1b7ebca0
pip@25.0.1
26.1.2
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.