Skip to content
fr Sign in
5.6 Medium

CVE-2026-13346 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary…

Description

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

Affected products and versions

Product Affected versions Fixed in
pip 26.2 earliest → < 26.2 26.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of pip

The 5 CVEs of pip →
CVE-2026-8643 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved… 4.1 Medium CVE-2026-3219 pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP… 4.6 Medium CVE-2026-1703 When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the… 2.0 Low CVE-2025-8869 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module… 5.9 Medium
Track this CVE