CVE-2026-6357

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

Affected products

Red Os, Pip

Fix

Available

CVSS 4.0

5.3 MEDIUM

EPSS

0.1% (4th percentile)

Weakness

CWE-829

NVD status

Awaiting Analysis

Published

2026-04-27

No exploit for CVE-2026-6357 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.