VDB
DEBIAN-CVE-2026-1703
DEBIAN-CVE-2026-1703
PUBLISHED
CVSS 2 LOW
Record from OSV · Published February 2, 2026
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| python-pip | Debian:14 | 26.0+dfsg-1 |
Risk scores
CVSS 4.0
2
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | python-pip | 0, 25.1.1+dfsg-1, 25.2+dfsg-1 |
| Debian:14 | python-pip | 0, 25.1.1+dfsg-1, 25.2+dfsg-1 |
| Debian:12 | python-pip | 24.3.1+dfsg-1, 25.0+dfsg-1, 25.0.1+dfsg-1 |
Timeline
- Feb 2, 2026 CVE Published
- Oct 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2026-1703
vulnetix vdb fixes DEBIAN-CVE-2026-1703Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2026-1703/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart