HCE2-SA-2026-0031 Moderate HCE 2.0 Security Fix(es): When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn_x27;t implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn_x27;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip_x27;s fallback implementation of tar extraction for Python versions that don_x27;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python _x27;tarfile_x27; module. If you_x27;re using a Python version that implements PEP 706 then pip doesn_x27;t use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice. (CVE-2025-8869) HCE 2.0 python3-pip-21.3.1-1.r12.hce2.noarch.rpm python-pip-help-21.3.1-1.r12.hce2.noarch.rpm python-pip-wheel-21.3.1-1.r12.hce2.noarch.rpm