alt Hacker News> An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index.
https://nvd.nist.gov/vuln/detail/cve-2018-20225
Because I'm sure the public wants to know.
To be fair this behavior + extra-index-url definitely allowed for dependency confusion attacks. Now it's a bit silly for the CVE as written, but IIRC this was before you could use index-url to point exclusively to an internal package host so there were (and in other ecosystems still are) dependency confusion attacks going on in the wild where attackers are publishing "[email protected]" on any public package host (NPM, PyPi, etc) to try to compromise companies that have internal packages of the same name.