# CVE-2026-13346

## Summary

- **CVE ID:** CVE-2026-13346
- **Severity:** MEDIUM
- **CVSS Score:** 5.6 (CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-36
- **Published:** Jul 29, 2026
- **Last Modified:** Jul 29, 2026

## Description

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.




This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

## Affected Products

- Python Packaging Authority — pip (0)

## References

- [CNA](https://github.com/pypa/pip/pull/14110)
- [CNA](https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/)
- [CVE](http://www.openwall.com/lists/oss-security/2026/07/29/7)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.29%
- **EPSS Percentile:** 21.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._