Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/pip@23.1.1
purl pkg:pypi/pip@23.1.1
Next non-vulnerable version 23.3
Latest non-vulnerable version 23.3
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-k5yn-bund-q3ab
Aliases:
CVE-2023-5752
GHSA-mq26-g339-26xf
PYSEC-2023-228
When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
23.3
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-30T20:33:10.365182+00:00 Pypa Importer Affected by VCID-k5yn-bund-q3ab https://github.com/pypa/advisory-database/blob/main/vulns/pip/PYSEC-2023-228.yaml 38.6.0