[dep-audit] vulnerability: pip untrusted control sphere (CVE-2026-6357)

[github-actions]

Vulnerability: pip Untrusted Control Sphere (CVE-2026-6357)

Package: pip
Installed version: 26.0.1
CVE: CVE-2026-6357
GHSA: GHSA-jp4c-xjxw-mgf9
Severity: MODERATE
Fix version: 26.1

Description

pip prior to version 26.1 runs its self-update check functionality after installing wheel files. This causes well-known Python module names to be imported shortly after wheel installation. An attacker who can influence the installed packages could substitute a malicious module that gets imported during pip's post-install self-update check.

The patch moves the self-update check to run before wheels are installed, preventing newly-installed modules from being imported during that phase.

Impact

This is a build-toolchain issue affecting the pip executable used inside the pixi environment. It is not a runtime vulnerability of the m365-extract application itself. Risk is limited to the development and CI environment where pip install is run.

Recommended fix

Bump pip in pixi.toml to require >=26.1:

pip = ">=26.1,<28"

Then run pixi install to update the lockfile.

References

• GHSA-jp4c-xjxw-mgf9
• https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes
• Split the pip self-version check to get info before run pypa/pip#13923