CVE-2019-20916: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command...

Security readout for executives and security teams

Older pip versions could save a downloaded file outside the intended directory when installing from a URL. A malicious or compromised download server could influence the filename and overwrite sensitive files. The business risk is highest in build systems, servers, or automation running pip before 19.2 with elevated privileges. Exposure is likely in legacy Python environments using pip before 19.2, especially CI, deployment scripts, containers, or admin workflows that install packages from direct URLs. Debian LTS, openSUSE, and Oracle advisories indicate downstream packaged environments also needed updates. Treat as a targeted legacy hygiene issue with high impact potential in automation. Prioritize systems where old pip runs as root or handles external URLs, but do not assume internet-wide exploitation from the provided evidence. Mitigation focus: Upgrade pip to 19.2 or later where possible.; Apply distro or vendor security updates for packaged python-pip.; Review Debian LTS, openSUSE, and Oracle guidance for covered systems..

Prepared

Jun 3, 2026, 10:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.