CVE-2026-13346: pip absolute path traversal during download from malicious package indexes
pip absolute path traversal during download from malicious package indexes
Other sources
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13346?
CVE-2026-13346 has a medium severity rating of 5.6 according to the CVSS scoring.
How does CVE-2026-13346 affect pip users?
CVE-2026-13346 allows pip to incorrectly handle doubly-encoded package URLs, potentially leading to the installation of files in arbitrary locations on disk.
What are the requirements for exploiting CVE-2026-13346?
To exploit CVE-2026-13346, an attacker must host a malicious package index and the user must download or install a package from that index.
How can I mitigate the risk posed by CVE-2026-13346?
To mitigate CVE-2026-13346, avoid installing packages from untrusted or unknown package indexes.
When was CVE-2026-13346 published?
CVE-2026-13346 was published on July 29, 2026.