Is CVE-2026-6357 actively exploited?

No active exploitation of CVE-2026-6357 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-6357 be exploited remotely?

No. CVE-2026-6357 requires local access to exploit.

What is the CVSS score of CVE-2026-6357?

CVE-2026-6357 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-6357

MEDIUM

CVE-2026-6357

CWE-829Published: April 27, 2026· Updated: Apr 27, 2026

5.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.7th

Official Description

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

NVD Source

Technical Analysis

CVE-2026-6357 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.High

User InteractionA

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X