# What changed in pip

> 5 changes in pip 25 to 26 from its official release notes, upgrade guides and advisories: 5 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/pypi/pip/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## pip 26

### Security

- pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory (26.1.2) — [security advisory](https://github.com/advisories/GHSA-WF93-45JW-7689)
- pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files (26.1) — [security advisory](https://github.com/advisories/GHSA-58QW-9MGM-455V)
- pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere (26.1) — [security advisory](https://github.com/advisories/GHSA-JP4C-XJXW-MGF9)
- pip Path Traversal vulnerability (26.0) — [security advisory](https://github.com/advisories/GHSA-6VGW-5PG2-W6JP)

## pip 25

### Security

- pip's fallback tar extraction doesn't check symbolic links point to extraction directory (25.3) — [security advisory](https://github.com/advisories/GHSA-4XH5-X5GV-QWPH)