Skip to content

Release 26.0.1.post1

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 22 Oct 19:06
· 0 commits to main since this release
26.0.1.post1
c9585e3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First ActiveState security release for pip 26.0.1, the last pip for Python 3.9 (26.1 requires 3.10). Merged in #7 and #9.

CVE Advisory Status
CVE-2026-3219 GHSA-58qw-9mgm-455v Patched
CVE-2026-6357 GHSA-jp4c-xjxw-mgf9 Patched
CVE-2026-8643 GHSA-wf93-45jw-7689 Patched (exploitable here; distlib 0.4.0)
CVE-2026-13346 GHSA-qwm4-qh6w-59xr Patched
— GHSA-6q48-6c7w-9gw2 Patched: vendored certifi 2026.1.4 → 2026.10.19 (emSign, critical)
CVE-2025-8869 GHSA-4xh5-x5gv-qwph Fixed in 26.0.1; hardened here with pypa#14127 (affects 3.9.0–3.9.16)
CVE-2026-1703 GHSA-6vgw-5pg2-w6jp Already fixed in 26.0.1

Review-round hardening (also in this release):

  • CVE-2025-8869 follow-up: pypa#14127 is ported, rejecting symlink redirection in the tar fallback.
  • Path checks: containment checks are root-safe and //-safe.
  • Archive members: symlink targets are matched against normalized member names.
  • Error messages: an unsafe download file name now gives a pip ERROR: instead of a traceback.

Validated on the built wheel, in the matching python:X-slim image:

  • CVE-2026-6357: the end-to-end _manylinux exploit is not executed.
  • CVE-2026-1703: the sibling-prefix wheel is blocked.
  • CVE-2025-8869: both pypa#14127 escape archives are refused.
  • Archive shapes: valid ./-prefixed and implied-directory archives unpack.
  • Bundled certifi: the bundle has no emSign ECC G3, TrustCor, E-Tugra or GLOBALTRUST roots.
  • Network: a real pip download from PyPI works.

sha256

  • pip-26.0.1.post1.tar.gz: f7498556845d8e6045239a761007fc024c3edcfd609ff1dd062485bedf7a370f
  • pip-26.0.1.post1-py3-none-any.whl: 6cd40409a936257162fe17e1585488a1804798057330fbba5b152a858919226d
Assets 4
Loading