Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
python-pip may extract malicious files from tar archives
published 1 year ago
Summary
The python-pip tool can mishandle tar files, allowing specially crafted archives to place files outside the intended folder. This can lead to unwanted code or data being written to your system. Update pip to the latest version and use a recent Python release (3.9.17 or newer) to eliminate the risk.
What to do
- Update azure python-pip to version 24.2-4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | python-pip |
< 24.2-4 Fix: upgrade to 24.2-4
|
Original advisory text
CVE-2025-8869 affecting package python-pip for versions less than 24.2-4
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.
Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.
Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706
and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706
then pip doesn't use the "vulnerable" fallback code.
Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),
applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.
Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706
and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706
then pip doesn't use the "vulnerable" fallback code.
Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),
applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
References
Timeline
Published24 Sep 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-67788 · OSV
Track software like this
Free during beta