Vulnerability in pip's tar extraction for Python versions lacking PEP 706 support

CVE-2025-8869

What is CVE-2025-8869?

The identified vulnerability in pip arises when extracting tar archives, where symbolic links may improperly refer to the extraction directory due to the inadequacy of the tarfile module's implementation in older Python versions. Specifically, if a Python version does not account for PEP 706, pip defaults to a fallback extraction process that exposes users to potential risks. It's vital for users on such versions to upgrade to a fixed pip version, or ideally, transition to Python versions that natively implement PEP 706. Other mitigative actions include applying recommended patches or thoroughly inspecting source distributions prior to installation.

References