CVE-2025-8869
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
24/09/2025
Last modified:
03/11/2025
Description
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706.<br />
Note that upgrading pip to a "fixed" version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.<br />
<br />
Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706<br />
and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706<br />
then pip doesn&#39;t use the "vulnerable" fallback code.<br />
<br />
Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),<br />
applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
Impact
Base Score 4.0
5.90
Severity 4.0
MEDIUM