CVE-2026-13346Disclosure(pypa / pip)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

pypa CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/pypa/pip/pull/14110

Vendor / third-party advisories

Weakness type (CWE)

CWE-36

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

pypa

Products

pip

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-13346

Full discourse1 post

CVE@CVEnew91d
Disclosure
CVE-2026-13346 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. … https://www.cve.org/CVERecord?id=CVE-2026-13346
Post summary
The text announces a new CVE (CVE‑2026‑13346) detailing how pip mishandles double‑encoded package URLs, potentially allowing arbitrary file installation. No PoC, exploit, patch, or evidence of active exploitation is mentioned.
00000637
57.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	pypa	pip	-	-	-

Explore more

Back to dashboard pypa CVEs pip vulnerabilities