Affected: Alpaquita:23: py3-pip, Alpaquita:25: py3-pip, Alpaquita:stream: py3-pip, BellSoft Hardened Containers:23: py3-pip, BellSoft Hardened Containers:25: py3-pip, BellSoft Hardened Containers:stream: py3-pip
Affected: Homebrew: azure-cli
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Withdrawn by the publisher.
Affected: CleanStart: python3
Package python3 version 3.11.15-r1 fixes 1 vulnerabilities: CVE-2026-13346
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Affected: PyPI: pip
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Affected: openEuler:20.03-LTS-SP4: python-pip
%changelog * Thu May 14 2026 markeryang <747675909@qq.com> - 23.3.1-11 - Fix CVE-2026-3219 Security Fix(es):
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.(CVE-2026-13346)
python311-pip-26.2-1.1 on GA media
Affected: PyPI: pip
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation pip: pip: Arbitrary file installation via malicious package indexes
Security update for python-pip
Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: pipenv, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: pipenv, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:24.04:LTS: pipenv, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:26.04:LTS: pipenv and 1 more
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.