CVE-2025-8869
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
24/09/2025
Última modificación:
03/11/2025
Descripción
*** Pendiente de traducción *** When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706.<br />
Note that upgrading pip to a "fixed" version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.<br />
<br />
Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706<br />
and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706<br />
then pip doesn&#39;t use the "vulnerable" fallback code.<br />
<br />
Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),<br />
applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
Impacto
Puntuación base 4.0
5.90
Gravedad 4.0
MEDIA