CLEANSTART-2026-VN85897: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels

Q: What would an attacker need to control to exploit this issue?

The attacker would need to provide a doubly encoded package URL through a package index used by pip. The affected installation flow includes wheel installation.

Q: Does the advisory provide a fixed version or a workaround for affected installations?

No fixed version, workaround, or configuration-based mitigation is provided in the available advisory data.

Published Nov 7, 2026

Updated

Security vulnerability affects the httpbin package. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.

Affected Software

1 affected componentFixes available

cleanstart/httpbin<0.2.3-r4

0.2.3-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/httpbin to a version that resolves this vulnerability.
Fixed in 0.2.3-r4

Event History

Nov 7, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-13346

Frequently Asked Questions

What would an attacker need to control to exploit this issue?

The attacker would need to provide a doubly encoded package URL through a package index used by pip. The affected installation flow includes wheel installation.

Does the advisory provide a fixed version or a workaround for affected installations?

No fixed version, workaround, or configuration-based mitigation is provided in the available advisory data.

CLEANSTART-2026-VN85897: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What would an attacker need to control to exploit this issue?

Does the advisory provide a fixed version or a workaround for affected installations?

Company

Resources

Contact

Frequently Asked Questions

What would an attacker need to control to exploit this issue?

Does the advisory provide a fixed version or a workaround for affected installations?