pipdeptree-2.22.0-py3-none-any.whl: 1 vulnerabilities (highest severity is: 3.5)

[mend-for-github-com]

Vulnerable Library - pipdeptree-2.22.0-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20251126140837_YAOJPN/python_UBHLPJ/202511261409241/env/lib/python3.9/site-packages/pip-25.3.dist-info

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (pipdeptree version)	Remediation Possible**
CVE-2026-1703	Low	3.5	pip-25.3-py3-none-any.whl	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-1703

Vulnerable Library - pip-25.3-py3-none-any.whl

The PyPA recommended tool for installing Python packages.

Library home page: https://files.pythonhosted.org/packages/44/3c/d717024885424591d5376220b5e836c2d5293ce2011523c9de23ff7bf068/pip-25.3-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20251126140837_YAOJPN/python_UBHLPJ/202511261409241/env/lib/python3.9/site-packages/pip-25.3.dist-info

Dependency Hierarchy:

• pipdeptree-2.22.0-py3-none-any.whl (Root Library)
  • ❌ pip-25.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

Publish Date: 2026-02-02

URL: CVE-2026-1703

CVSS 3 Score Details (3.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6vgw-5pg2-w6jp

Release Date: 2026-02-02

Fix Resolution: pip - 26.0