- CVE-2026-13346: doubly-encoded package URL from an index could write files to arbitrary paths on download - CVE-2025-8869: tar extraction did not verify symlink members point inside the extraction directory - CVE-2026-1703: is_within_directory used commonprefix, allowing extraction to a sibling path sharing a name prefix; the containment check now compares resolved paths directly - CVE-2026-3219: concatenated tar and zip archives were always treated as zip; reject ambiguous archive signatures - CVE-2026-6357: self-version check imported modules after installing wheels; run the check before command execution - CVE-2026-8643: console_scripts and gui_scripts entry point names could install scripts outside the scripts directory