Bug 2463234 (CVE-2026-6357)

Summary: CVE-2026-6357 pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, alinfoot, alizardo, anpicker, anthomas, aprice, bbrownin, bdettelb, brasmith, cahl, caswilli, cochase, derez, dfreiber, doconnor, dranck, drow, dschmidt, dtrifiro, eborisov, eglynn, ehelms, erezende, ggainey, gtanzill, hasun, jburrell, jbuscemi, jchui, jdobes, jfula, jhe, jjoyce, jkoehler, jlanda, jmitchel, jowilson, jpasqual, jsamir, juwatts, jwong, kaycoth, kbempah, kgaikwad, kshier, ktsao, lball, lichen, ljawale, lphiri, luizcosta, mburns, mgarciac, mhulan, mrunge, msilmser, nboldt, ngough, nmoumoul, nweather, nyancey, oaljalju, oezr, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, psrna, ptisnovs, rbobbitt, rbryant, rchan, rhel-process-autobot, rjohnson, sdawley, simaishi, smallamp, smcdonal, solenoci, stcannon, sthirugn, syedriko, teagle, tmalecek, ttakamiy, veshanka, vimartin, vkumar, watson-tool-maintainers, weaton, xdharmai, xialiu, xiaoxwan, yguenane, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in pip. Prior to version 26.1, pip's self-update check functionality would execute after installing wheel packages. This process involved importing newly installed Python modules. A malicious actor could craft a specially designed wheel package that, when installed, could lead to the execution of arbitrary code or information disclosure due to the premature import of its modules during the self-update check.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-27 15:03:16 UTC
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.