CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
Other sources
pip self-update functionality can import newly installed modules after wheel installation
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6357?
CVE-2026-6357 is rated as a moderate severity vulnerability due to its potential risk of executing arbitrary code through unverified module imports after a wheel installation.
How do I fix CVE-2026-6357?
To fix CVE-2026-6357, upgrade pip to version 26.1 or later to ensure that self-update functionality no longer imports new modules during wheel installations.
What causes CVE-2026-6357?
CVE-2026-6357 is caused by pip's self-update feature which inadvertently imports potentially unverified modules after installing wheel files in versions prior to 26.1.
In which versions of pip does CVE-2026-6357 exist?
CVE-2026-6357 affects pip versions prior to 26.1.
What impact does CVE-2026-6357 have on users?
CVE-2026-6357 can lead to unauthorized module imports, potentially allowing attackers to execute arbitrary Python code on systems using affected pip versions.