—

PYSEC-2026-2876

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

Quick fix

PYSEC-2026-2876 — pip: upgrade to the fixed version with the command below.

pip install --upgrade 'pip>=26.1'

Details

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/pip

Introduced in: 0Fixed in: 26.1

Fixpip install --upgrade 'pip>=26.1'

References

https://nvd.nist.gov/vuln/detail/CVE-2026-6357[ADVISORY]
https://github.com/pypa/pip/pull/13923[WEB]
https://github.com/pypa/pip/commit/b369bfc96cc524e00c267e1693290e6599c36bad[WEB]
https://github.com/pypa/pip[PACKAGE]
https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes[WEB]
http://www.openwall.com/lists/oss-security/2026/04/27/7[WEB]
https://pypi.org/project/pip[PACKAGE]
https://github.com/advisories/GHSA-jp4c-xjxw-mgf9[ADVISORY]