Vulnerability Description
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Related Weaknesses (CWE)
References
- https://github.com/pypa/pip/pull/14110
- https://mail.python.org/archives/list/[email protected]/thread/L2BNQG
- http://www.openwall.com/lists/oss-security/2026/07/29/7
FAQ
What is CVE-2026-13346?
CVE-2026-13346 is a documented vulnerability. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires dow...
How severe is CVE-2026-13346?
CVSS scoring is not yet available for CVE-2026-13346. Check NVD for updates.
Is there a patch for CVE-2026-13346?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.