pip's fallback tar extraction doesn't check symbolic links point to extraction directory
Moderate severity
GitHub Reviewed
Published
Sep 24, 2025
to the GitHub Advisory Database
•
Updated Dec 19, 2025
Give feedback on Dependabot alerts