Recommended action

Update pip to 26.1.2 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory affects pip (pip). Severity is medium. pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

AI coding agents often install or upgrade packages automatically in pip. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Fixed versions are reported by the source feed; confirm compatibility before updating.

Recommended action

Update pip to 26.1.2 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory affects pip (pip). Severity is medium. pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

AI coding agents often install or upgrade packages automatically in pip. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Fixed versions are reported by the source feed; confirm compatibility before updating.