CyberRota Analysis
AI-GeneratedThis vulnerability affects users of pip who utilize the `--only-binary` option while downloading packages from potentially malicious package indexes, allowing arbitrary file installation on disk due to improper handling of doubly-encoded URLs. The impact is significant for those environments where pip is used to manage dependencies, particularly in automated or CI/CD pipelines. Organizations that rely on pip for package management should prioritize addressing this issue to mitigate the risk of unauthorized file installations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Related CVEs
Other vulnerabilities affecting the same vendor(s)