CVE-2026-8643
HighAdvisory
Published 1 Jun 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.0
- base score, highest
- EPSS
- 0.003
- 25th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,282
- of 17,790 indexed, latest versions
- Container images
- 1,231
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
Carried by container images the latest versions of 1,282 of 17,790 indexed charts deploy, on 1,231 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| pippypi | 1.5.4, 8.1.1, 8.1.2, 9.0.0+67 more | 26.1.2 | 1,224 |
| python-pipdeb | 1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more | no fix listed | 141 |
- OSV records
- GHSA-wf93-45jw-7689UBUNTU-CVE-2026-8643DEBIAN-CVE-2026-8643
- Also known as
- PYSEC-2026-196
Charts affected
1,282 by stars
Container images carrying it
1,231 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| galaxy/ | 8e577a626dfd | pip python-pip | 26.1.2 no fix listed | 1 |
| galaxy/ | e50a890e24c9 | pip python-pip | 26.1.2 no fix listed | 1 |
| genseb/ | cb7599641099 | pip | 26.1.2 | 1 |
| geonode/ | 81b1d431b7e9 | pip python-pip | 26.1.2 no fix listed | 1 |
| geopython/ | 84662ea6b78b | pip | 26.1.2 | 1 |
| geoscienceaustralia/ | f4039b45572a | pip python-pip | 26.1.2 no fix listed | 1 |
| gethue/ | 11b649636e68 | pip python-pip | 26.1.2 no fix listed | 1 |
| gethue/ | 5702b2c37ff9 | pip python-pip | 26.1.2 no fix listed | 1 |
| gethue/ | 7d5c1b9f8a79 | pip python-pip | 26.1.2 no fix listed | 1 |
| getsentry/ | 6ac37974fd2a | pip | 26.1.2 | 1 |
| gluufederation/ | 1a1128b28b95 | pip | 26.1.2 | 1 |
| gmaas2/ | 148fc2d9afe9 | pip | 26.1.2 | 1 |
| gmelillo/ | c599d608a2f7 | pip | 26.1.2 | 1 |
| golenski/ | 86ca17cd3063 | pip | 26.1.2 | 1 |
| gomods/ | d714c7ff0231 | pip | 26.1.2 | 1 |
| gomods/ | efb811df7844 | pip | 26.1.2 | 1 |
| goofball222/ | 43c0743701d4 | pip | 26.1.2 | 1 |
| goofball222/ | 7bf26032dfce | pip | 26.1.2 | 1 |
| gpappsoft/ | af7841adad26 | pip | 26.1.2 | 1 |
| grafana/ | 499851658393 | pip | 26.1.2 | 1 |
| graphiteapp/ | 04a0037cc2ae | pip | 26.1.2 | 1 |
| greenbirdit/ | e99d53bdc944 | pip | 26.1.2 | 1 |
| greenkube/ | 0c01932282a4 | pip | 26.1.2 | 1 |
| gristlabs/ | 6e71b1914a7e | pip | 26.1.2 | 1 |
| grpl/ | c00aafee6629 | pip python-pip | 26.1.2 no fix listed | 1 |
| guillh/ | 4fb99dbc32b2 | pip | 26.1.2 | 1 |
| ha33ona/ | 6affdfc644d0 | pip | 26.1.2 | 1 |
| halkeye/ | 77b05e95fdb5 | pip | 26.1.2 | 1 |
| hamidyousefi93/ | c34f071f6ed0 | pip | 26.1.2 | 1 |
| hammerspaceinc/ | 395bee4504fc | pip | 26.1.2 | 1 |
| hamzaarshad10/ | 2c1c3b86a8e7 | pip | 26.1.2 | 1 |
| hamzaarshad10/ | 154f38e8668e | pip | 26.1.2 | 1 |
| hansehe/ | bc8e45262bc4 | pip | 26.1.2 | 1 |
| hayk96/ | 86377705e9e3 | pip | 26.1.2 | 1 |
| hazelcast/ | f9d34300d330 | pip | 26.1.2 | 1 |
| hcguersoy/ | 63b76fdcfbe1 | pip | 26.1.2 | 1 |
| healthchecks/ | e82bb0836e30 | pip | 26.1.2 | 1 |
| heartexlabs/ | aa461572e8f9 | pip | 26.1.2 | 1 |
| helga09/ | a03657d97897 | pip | 26.1.2 | 1 |
| helicone/ | 4c69b971a7e4 | pip python-pip | 26.1.2 no fix listed | 1 |
| helmforge/ | 61f759a1421f | pip | 26.1.2 | 1 |
| helmforge/ | fcb7017327d6 | pip | 26.1.2 | 1 |
| hhyo/ | 1aa41843419e | pip | 26.1.2 | 1 |
| hiboxsystems/ | 7235809b43b3 | pip | 26.1.2 | 1 |
| hiboxsystems/ | a96c10b61a59 | pip | 26.1.2 | 1 |
| hiboxsystems/ | b59f01bc0418 | pip | 26.1.2 | 1 |
| hiboxsystems/ | dcffb926e563 | pip | 26.1.2 | 1 |
| hjacobs/ | 5d328c003efe | pip | 26.1.2 | 1 |
| hjacobs/ | fbb303ed463c | pip | 26.1.2 | 1 |
| hjacobs/ | a4fae38f93d7 | pip | 26.1.2 | 1 |