AIKIDO-2026-240948

TL;DR

pip resolves a package path from a pylock.toml lock file by URL-joining it to the lock file's own location, but does not confirm the result stays on the lock file's scheme and host. When the lock file is fetched from a URL, a path that carries its own URL scheme or authority (for example a file: target or another host) is not seen as absolute, so the join adopts that scheme and host and discards the lock file's base. This lets an externally supplied lock file redirect pip to a local file:// resource or a different remote host, enabling server-side request forgery and access to local filesystem paths. The fix rejects a resolved package path whose scheme or host differs from the URL-fetched lock file's own.