Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pypa/pip

              main @ 72e6c59
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Path Traversal: 2 prior fixes. Scrutinize any change in this area.

pip: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Malicious entry point names (like console_scripts or gui_scripts) inside wheel packages can escape the target scripts or installation directory, allowing arbitrary file writes during package installation. This is a recurring high-severity risk when installing untrusted Python packages.

Credential Leakage: Using character-by-character prefix matching via `os.path.commonprefix` instead of segment-aware path comparison allows credentials intended for a specific scope to leak to unauthorized, similarly-named index URLs.

Path Traversal: Failure to validate and sanitize target extraction and script generation paths allows remote attackers to trigger arbitrary file writes via crafted HTTP Content-Disposition headers or malicious archive layouts.