Homepage
About Snyk

pip@21.2 vulnerabilities

The PyPA recommended tool for installing Python packages.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the pip package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Arbitrary Command Injection

Affected versions of this package are vulnerable to Arbitrary Command Injection when installing a package from a Mercurial VCS URL. An attacker can inject arbitrary configuration options to the hg clone call via the --config option, which can modify how and which repository is installed. This is only exploitable when installing from Mercurial VCS URLs..

How to fix Arbitrary Command Injection?

Upgrade pip to version 23.3 or higher.

[,23.3)
Go back to all versions of this package