CVE-2021-3572

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

View graph Watch Export

CVSS v3.1

5.7 MEDIUM

EPSS

1.83%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

EPSS Trend

Aug 16, 2026 → Sep 4, 2026

▲ 0.14pp

1.69% → 1.83% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

ScopeUNCHANGED

ConfidentialityNONE

IntegrityHIGH

AvailabilityNONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Connections

6 relationships

CWE-20

source

Timeline

disclosure → media coverage

Nov 10, 2021

Disclosure — published as a CVE record. · last revised by NVD Aug 25, 2026

Public PoC (1)

github.com/frenzymadness/CVE-2021-3572

Unverified third-party code — review before executing.