CVE-2026-13346

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13346
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13346.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13346
Aliases
Downstream
AZL (2)
BELL (1)
CGA (49)
CLEANSTART (5)
CLSA (1)
DEBIAN (1)
ECHO (1)
MINI (10)
OESA (5)
openSUSE (3)
RHSA (1)
SUSE (9)
UBUNTU (1)
Related
openSUSE (3)
SUSE (9)
Published
2026-07-29T18:33:50Z
Modified
2026-09-15T17:11:41Z
Severity
  • 5.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
pip absolute path traversal during download from malicious package indexes
Details

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.

This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

Database specific 
{
    "cna_assigner":  "PSF",
    "cwe_ids":  [
        "CWE-36"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13346.json"
}
References

Affected packages

Git / github.com/pypa/pip

Affected ranges

Type
GIT
Repo
https://github.com/pypa/pip
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4b6ae5c4d7d63a61a99fbecbead8dbc35cc8b357
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "26.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

0.*
0.3
0.6
0.7
0.7.1
0.8
0.8.2
0.8.3
1.*
1.0
1.2
1.4rc1
1.4rc2
10.*
10.0.0
10.0.1
18.*
18.0
18.1
19.*
19.0
19.0.2
19.1.1
20.*
20.0.2
21.*
21.0
21.3
26.*
26.0
6.*
6.0
9.*
9.0.0
9.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13346.json"