GHSA-qwm4-qh6w-59xr
pip would incorrectly handle doubly-encoded package URLs from indexes
At a glance
- Published
- Updated
- CVE
- CVE-2026-13346
- Aliases
- PYSEC-2026-3721
- CVSS_V4
- CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Affected packages
| Package | Versions |
|---|---|
| PyPI · pip | introduced 0, fixed 26.2.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-13346 ADVISORY
- https://github.com/pypa/pip/pull/14110 WEB
- https://github.com/pypa/pip/commit/10dfb6b9005484578b386f64b9f36982e3dc6679 WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-3721.yaml WEB
- https://github.com/pypa/pip PACKAGE
- https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX WEB
- http://www.openwall.com/lists/oss-security/2026/07/29/7 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |