Catalogo CVE
CVE-2026-13346
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires dow
- Gravità
- Medium · CVSS 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.29% · Oct 23, 2026
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-pip | sid | 26.2.2+dfsg-1 | fixed |
| Debian | python-pip | forky | 26.2.2+dfsg-1 | fixed |
| Debian | python-pip | trixie | 25.1.1+dfsg-1 | vulnerable |
| Debian | python-pip | bookworm | 23.0.1+dfsg-1 | vulnerable |
| Cpe | pip | Not reported | 26.2 | fixed |
| PyPI | pip | Not reported | 26.2 | fixed |
| PyPI | pip | Not reported | 26.2.0 | fixed |
| Suse | python3 | linux enterprise server ltss extended security 12 sp5 | 3.4.10-25.194.2 | fixed |
| Suse | python3-base | linux enterprise server ltss extended security 12 sp5 | 3.4.10-25.194.2 | fixed |
| Suse | python | linux enterprise server ltss extended security 12 sp5 | 2.7.18-33.85.2 | fixed |
| Suse | python-base | linux enterprise server ltss extended security 12 sp5 | 2.7.18-33.85.2 | fixed |
| Suse | python-doc | linux enterprise server ltss extended security 12 sp5 | 2.7.18-33.85.2 | fixed |
| Suse | python313-pip | linux enterprise module for python 3 15 sp7 | 24.2-150700.3.3.1 | fixed |
| Suse | python | linux enterprise module for package hub 15 sp7 | 2.7.18-150000.126.1 | fixed |
| Suse | python-base | linux enterprise module for package hub 15 sp7 | 2.7.18-150000.126.1 | fixed |
| Suse | python-pip | linux enterprise server 16.0 | 25.0.1-160000.6.1 | fixed |
| Suse | python-pip | linux enterprise server for sap applications 16.0 | 25.0.1-160000.6.1 | fixed |
| Opensuse | python310 | tumbleweed | 3.10.20-10.1 | fixed |
| Suse | python36-pip | linux enterprise server ltss extended security 12 sp5 | 20.2.4-8.18.1 | fixed |
| Opensuse | python-pip | leap 16.0 | 25.0.1-160000.6.1 | fixed |
| Suse | python3-pip | linux enterprise module for basesystem 15 sp7 | 20.0.2-150400.26.1 | fixed |
| Suse | python3-pip-wheel | linux enterprise module for basesystem 15 sp7 | 20.0.2-150400.26.1 | fixed |
| Suse | python-pip | linux enterprise module for public cloud 15 sp4 | 22.3.1-150400.17.29.1 | fixed |
| Suse | python-pip | linux enterprise module for python 3 15 sp7 | 22.3.1-150400.17.29.1 | fixed |
| Opensuse | python-pip | tumbleweed | 26.2-1.1 | fixed |
| Suse | python36 | linux enterprise server 12 sp5-ltss | 3.6.15-125.1 | fixed |
| Suse | python36-core | linux enterprise server 12 sp5-ltss | 3.6.15-125.1 | fixed |
| Suse | python36 | linux enterprise server ltss extended security 12 sp5 | 3.6.15-125.1 | fixed |
| Suse | python36-core | linux enterprise server ltss extended security 12 sp5 | 3.6.15-125.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-pip | source | sid | 26.2.2+dfsg-1 | not yet assigned | Not reported | [1143072] |
| Debian | python-pip | source | forky | 26.2.2+dfsg-1 | not yet assigned | Not reported | [1143072] |
| Debian | python-pip | source | trixie | (unfixed) | not yet assigned | Not reported | [1143072] |
| Debian | python-pip | source | bookworm | (unfixed) | not yet assigned | Not reported | [1143072] |
| Cpe | pip | cpe | Not reported | 26.2 | Not reported | NVD-CVE-2026-13346 | Not reported |
| PyPI | pip | PyPI | Not reported | 26.2 | Not reported | PYSEC-2026-3721 | Not reported |
| PyPI | pip | PyPI | Not reported | 26.2.0 | Not reported | GHSA-QWM4-QH6W-59XR | Not reported |
| Suse | python3 | rpm | linux enterprise server ltss extended security 12 sp5 | 3.4.10-25.194.2 | Not reported | SUSE-SU-2026:4060-1 | Not reported |
| Suse | python3-base | rpm | linux enterprise server ltss extended security 12 sp5 | 3.4.10-25.194.2 | Not reported | SUSE-SU-2026:4060-1 | Not reported |
| Suse | python | rpm | linux enterprise server ltss extended security 12 sp5 | 2.7.18-33.85.2 | Not reported | SUSE-SU-2026:4061-1 | Not reported |
| Suse | python-base | rpm | linux enterprise server ltss extended security 12 sp5 | 2.7.18-33.85.2 | Not reported | SUSE-SU-2026:4061-1 | Not reported |
| Suse | python-doc | rpm | linux enterprise server ltss extended security 12 sp5 | 2.7.18-33.85.2 | Not reported | SUSE-SU-2026:4061-1 | Not reported |
| Suse | python313-pip | rpm | linux enterprise module for python 3 15 sp7 | 24.2-150700.3.3.1 | Not reported | SUSE-SU-2026:4030-1 | Not reported |
| Suse | python | rpm | linux enterprise module for package hub 15 sp7 | 2.7.18-150000.126.1 | Not reported | SUSE-SU-2026:3969-1 | Not reported |
| Suse | python-base | rpm | linux enterprise module for package hub 15 sp7 | 2.7.18-150000.126.1 | Not reported | SUSE-SU-2026:3969-1 | Not reported |
| Suse | python-pip | rpm | linux enterprise server 16.0 | 25.0.1-160000.6.1 | Not reported | SUSE-SU-2026:23319-1 | Not reported |
| Suse | python-pip | rpm | linux enterprise server for sap applications 16.0 | 25.0.1-160000.6.1 | Not reported | SUSE-SU-2026:23319-1 | Not reported |
| Opensuse | python310 | rpm | tumbleweed | 3.10.20-10.1 | Not reported | OPENSUSE-SU-2026:11690-1 | Not reported |
| Suse | python36-pip | rpm | linux enterprise server ltss extended security 12 sp5 | 20.2.4-8.18.1 | Not reported | SUSE-SU-2026:3846-1 | Not reported |
| Opensuse | python-pip | rpm | leap 16.0 | 25.0.1-160000.6.1 | Not reported | OPENSUSE-SU-2026:21643-1 | Not reported |
| Suse | python3-pip | rpm | linux enterprise module for basesystem 15 sp7 | 20.0.2-150400.26.1 | Not reported | SUSE-SU-2026:3588-1 | Not reported |
| Suse | python3-pip-wheel | rpm | linux enterprise module for basesystem 15 sp7 | 20.0.2-150400.26.1 | Not reported | SUSE-SU-2026:3588-1 | Not reported |
| Suse | python-pip | rpm | linux enterprise module for public cloud 15 sp4 | 22.3.1-150400.17.29.1 | Not reported | SUSE-SU-2026:3589-1 | Not reported |
| Suse | python-pip | rpm | linux enterprise module for python 3 15 sp7 | 22.3.1-150400.17.29.1 | Not reported | SUSE-SU-2026:3589-1 | Not reported |
| Opensuse | python-pip | rpm | tumbleweed | 26.2-1.1 | Not reported | OPENSUSE-SU-2026:11451-1 | Not reported |
| Suse | python36 | rpm | linux enterprise server 12 sp5-ltss | 3.6.15-125.1 | Not reported | SUSE-SU-2026:4743-1 | Not reported |
| Suse | python36-core | rpm | linux enterprise server 12 sp5-ltss | 3.6.15-125.1 | Not reported | SUSE-SU-2026:4743-1 | Not reported |
| Suse | python36 | rpm | linux enterprise server ltss extended security 12 sp5 | 3.6.15-125.1 | Not reported | SUSE-SU-2026:4743-1 | Not reported |
| Suse | python36-core | rpm | linux enterprise server ltss extended security 12 sp5 | 3.6.15-125.1 | Not reported | SUSE-SU-2026:4743-1 | Not reported |
Notes
[trixie] python-pip: Minor issue [bookworm] python-pip: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-pip]Interessata
Pacchetto sorgente: [python-pip]
Dettagli (2)
23.0.1+dfsg-1· all · bookwormInteressata
nvd · python-pip · debian · bookworm; nvd · python-pip · debian · 12
23.0.1+dfsg-1· all · bookwormInteressata
nvd · python-pip · debian · bookworm; nvd · python-pip · debian · 12
- [python3-pip-whl]Interessata
Pacchetto sorgente: [python-pip]
Dettagli (2)
23.0.1+dfsg-1· all · bookwormInteressata
nvd · python-pip · debian · bookworm; nvd · python-pip · debian · 12
23.0.1+dfsg-1· all · bookwormInteressata
nvd · python-pip · debian · bookworm; nvd · python-pip · debian · 12
[Debian 13 (Trixie)]
- [python3-pip]Interessata
Pacchetto sorgente: [python-pip]
Dettagli (2)
25.1.1+dfsg-1· all · trixieInteressata
nvd · python-pip · debian · 13
25.1.1+dfsg-1· all · trixieInteressata
nvd · python-pip · debian · 13
- [python3-pip-whl]Interessata
Pacchetto sorgente: [python-pip]
Dettagli (2)
25.1.1+dfsg-1· all · trixieInteressata
nvd · python-pip · debian · 13
25.1.1+dfsg-1· all · trixieInteressata
nvd · python-pip · debian · 13
[openSUSE Tumbleweed]
- [python310]Interessata
Pacchetto sorgente: [python310]
Dettagli (1)
3.10.20-9.1· x86_64 · tumbleweedInteressata · Corretta:
3.10.20-10.1nvd · python310 · opensuse · tumbleweed
- [python310-curses]Sconosciuto
Pacchetto sorgente: [python310]
Dettagli (1)
3.10.20-9.1· x86_64 · tumbleweedSconosciuto · Corretta:
3.10.20-10.1Version impact unknown
nvd · python310 · opensuse · tumbleweed
- [python310-dbm]Sconosciuto
Pacchetto sorgente: [python310]
Dettagli (1)
3.10.20-9.1· x86_64 · tumbleweedSconosciuto · Corretta:
3.10.20-10.1Version impact unknown
nvd · python310 · opensuse · tumbleweed
- [python310-idle]Sconosciuto
Pacchetto sorgente: [python310]
Dettagli (1)
3.10.20-9.1· x86_64 · tumbleweedSconosciuto · Corretta:
3.10.20-10.1Version impact unknown
nvd · python310 · opensuse · tumbleweed
- [python310-tk]Sconosciuto
Pacchetto sorgente: [python310]
Dettagli (1)
3.10.20-9.1· x86_64 · tumbleweedSconosciuto · Corretta:
3.10.20-10.1Version impact unknown
nvd · python310 · opensuse · tumbleweed
- [python311-pip]Sconosciuto
Pacchetto sorgente: [python-pip]
Dettagli (1)
26.2-1.1· noarch · tumbleweedSconosciuto · Corretta:
26.2-1.1Version impact unknown
nvd · python-pip · opensuse · tumbleweed
- [python311-pip-wheel]Sconosciuto
Pacchetto sorgente: [python-pip]
Dettagli (1)
26.2-1.1· noarch · tumbleweedSconosciuto · Corretta:
26.2-1.1Version impact unknown
nvd · python-pip · opensuse · tumbleweed
- [python312-pip]Sconosciuto
Pacchetto sorgente: [python-pip]
Dettagli (1)
26.2-1.1· noarch · tumbleweedSconosciuto · Corretta:
26.2-1.1Version impact unknown
nvd · python-pip · opensuse · tumbleweed
- [python312-pip-wheel]Sconosciuto
Pacchetto sorgente: [python-pip]
Dettagli (1)
26.2-1.1· noarch · tumbleweedSconosciuto · Corretta:
26.2-1.1Version impact unknown
nvd · python-pip · opensuse · tumbleweed
- [python313-pip]Sconosciuto
Pacchetto sorgente: [python-pip]
Dettagli (1)
26.2-1.1· noarch · tumbleweedSconosciuto · Corretta:
26.2-1.1Version impact unknown
nvd · python-pip · opensuse · tumbleweed
- [python313-pip-wheel]Sconosciuto
Pacchetto sorgente: [python-pip]
Dettagli (1)
26.2-1.1· noarch · tumbleweedSconosciuto · Corretta:
26.2-1.1Version impact unknown
nvd · python-pip · opensuse · tumbleweed
- [python314-pip]Sconosciuto
Pacchetto sorgente: [python-pip]
Dettagli (1)
26.2-1.1· noarch · tumbleweedSconosciuto · Corretta:
26.2-1.1Version impact unknown
nvd · python-pip · opensuse · tumbleweed
- [python314-pip-wheel]Sconosciuto
Pacchetto sorgente: [python-pip]
Dettagli (1)
26.2-1.1· noarch · tumbleweedSconosciuto · Corretta:
26.2-1.1Version impact unknown
nvd · python-pip · opensuse · tumbleweed
Osservato:
Riferimenti
- [http://www.openwall.com/lists/oss-security/2026/07/29/7]
- [https://access.redhat.com/errata/RHSA-2026:48788]
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4580-1.json]
- [https://github.com/pypa/pip/pull/14110]
- [https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-13346]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-13346]
- [https://osv.dev/vulnerability/PYSEC-2026-3721]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23319-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3588-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3589-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3846-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3969-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4030-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4060-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4061-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4743-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11451-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11690-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21643-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-13346]
[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]