CVE-2026-8643: pip console_scripts Out-of-Directory Arbitrary File Overwrite

HERMES

HERMES THREAT SCORE & APPLICATION RUNTIME ATTACK SURFACE

Target: pip (src/pip/_internal/operations/install/wheel.py)

Confidence: 94%

82 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-8643 at 7.1 (HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The Hermes Threat Score evaluates operational impact at 82 (HIGH) reflecting broad ecosystem exposure across data pipelines, MLOps, and developer environments.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-8643: pip console_scripts Out-of-Directory Arbitrary File OverwriteVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTpip Python Package Installer

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in pip Python Package Installer documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Security Advisory: CWE-22: Improper Limitation of a Pathname to a Restricted Directory

CVSS v3.1 : 7.1 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) / CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Addressed in official upstream release 26.1.2.

Executive Summary

CVE-2026-8643 affects the Python Packaging Authority (PyPA) pip installer versions 24.0 through 26.1.1. When installing Python packages distributed as wheel archives (.whl), pip treats entry points specified in entry_points.txt under [console_scripts] and [gui_scripts] as filenames to be generated in sys.prefix/bin. However, pip failed to validate that script names did not contain path traversal sequences or absolute paths. A malicious wheel can write wrapper scripts outside the target environment into directories like /etc/cron.d/ or ~/.bashrc, achieving persistent arbitrary code execution upon package installation.

---

1. Technical Context & Affected Software Matrix

The component pip (src/pip/_internal/operations/install/wheel.py) provides fundamental runtime services and data parsing across Python microservices, analytics pipelines, and AI platforms.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-8643	Official Upstream Security Release
Affected Product	pypa:pip	Python Ecosystem Component
Vulnerable Component	pip (src/pip/_internal/operations/install/wheel.py)	Standard Library / Package Utility
Weakness Class	CWE-22: Improper Limitation of a Pathname to a Restricted Directory	Execution / Resource Safety Flaw
CVSS v3.1 Score	7.1 (HIGH / Hermes Score 82)	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Fixed Version	26.1.2	Official upstream patch release
MITRE ATT&CK	T1546 - Event Triggered Execution, T1036 - Masquerading	Execution / Denial of Service
Forensic Cross-Reference	Python Package Integrity and Scripts Forensics	Memory analysis and process diagnostics

---

2. In-Depth Technical Decomposition & Root Cause

Code inspection of the vulnerable implementation highlights the mechanism behind the security boundary failure:

# Flaw in src/pip/_internal/operations/install/wheel.py
def install_scripts(entry_points, bin_dir):
    for name, target in entry_points.items():
        # VULNERABILITY: name treated as path without checking os.path.basename!
        # If name is '../../../../etc/cron.d/pwn', it escapes bin_dir!
        script_path = os.path.join(bin_dir, name)
        with open(script_path, "w") as f:
            f.write(generate_wrapper(target))
        os.chmod(script_path, 0o755)

When unvetted user input reaches this routine, the application encounters an unhandled edge case or unbounded processing loop, destabilizing the execution environment or enabling control-flow manipulation.

---

3. Attack Scenarios & Threat Modeling

1. Initial Vector & Preconditions: A developer or CI system installs a dependency from PyPI or a private mirror using pip install malicious-pkg.
2. Triggering Primitive: The attacker injects crafted payload data targeting pip (src/pip/_internal/operations/install/wheel.py).
3. Control Bypass / Resource Saturation: Flaw in src/pip/_internal/operations/install/wheel.py.
4. Impact Realization: The next hour, cron executes the payload with root permissions..

---

4. Forensic Detection, Artifacts & System Logs

Security operations centers and incident response teams can identify exploitation activity through process telemetry, memory dumps, and operating system audit trails.

Process Telemetry & Logs

Inspect application logs and process crash diagnostics matching: audit: type=1300 ... path="/etc/cron.hourly/" syscall=openat comm="pip". Monitor for abnormal CPU spikes or unexpected out-of-memory terminations.

System Auditing & Call Tracing

Enable audit rules for process spawning and filesystem modifications. Consult Python Package Integrity and Scripts Forensics.

Threat Hunting Rule (Sigma / Auditd)

Sigma Rule

sigma_cve_2026_8643.yaml

title: pip Installer Creating Executable Outside Target Python Bin Directory
id: cve-2026-8643
status: experimental
description: Detects anomalies and resource abuse associated with CVE-2026-8643.
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        - 'audit:'
        - 'pip'
    condition: selection
fields:
    - CommandLine
    - User
level: high

eBPF Tracepoint

# Monitor invocations associated with pypa:pip
sudo bpftrace -e '
tracepoint:syscalls:sys_enter_execve /comm == "python3"/ {
    printf("PID %d spawned: %s\n", pid, str(args->filename));
}'

---

5. Remediation & Hardening Guidelines

Immediate remediation involves upgrading to patched library versions and enforcing input sanitization best practices:

1. Package Upgrade: Update pypa:pip to version 26.1.2 or higher using pip install --upgrade or distribution security repositories.
2. Defensive Programming: Enforce strict size quotas, input schema validation, and disable unsafe deserialization primitives (replace pickle with safetensors or JSON).
3. Forensic Guidance: For complete forensic telemetry workflows, consult our guide on Python Package Integrity and Scripts Forensics.