Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pip | pip | < 26.1.2 | 26.1.2 |
Miggo AIRoot Cause AnalysisThe analysis of the provided security patch (commit 7f85b4d60f6efc690baf11266650eaba0b1d6c46) reveals that the path traversal vulnerability was addressed in the src/pip/_internal/operations/install/wheel.py file. The core of the vulnerability was that entry point names for console_scripts and gui_scripts were not sanitized. The PipScriptMaker.make method is responsible for creating these scripts. The patch introduces a check within the _raise_for_invalid_entrypoint helper function, which is now called by make with the script's target directory. The new _script_within_dir function ensures that the resolved path of the script is within the designated scripts directory. Since the make method is the function that initiates the script creation process using the potentially malicious entry point name, it is identified as the vulnerable function. During exploitation, a call to this function with a malicious entry point specification would appear in a runtime profile.
PipScriptMaker.makesrc/pip/_internal/operations/install/wheel.py