CGA-qff3-qwfv-7pph

This vulnerability is part of urllib, which is vendored into pip. Upstream intervention is required to update this dependency and address the associated CVE. See open issue upstream under pip: https://github.com/pypa/pip/issues/12857