CVE-2026-6357 Details
Description
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
A vulnerability exists in Python pip versions prior to 26.1, where the self-update check is performed after installing wheel files that require importing certain Python modules. This delay in importing modules was intended to reduce startup time for the pip command-line interface. The issue can lead to arbitrary code execution if pip's own modules are overwritten during the installation process, allowing for the execution of malicious code.
Users can update to pip version 26.1 or later, where this vulnerability has been fixed. Instructions for updating pip are available in the pip documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | CVE Modified | CVE |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | New CVE Received | [email protected] |