Most recent entries from all

bdu:2026-15256

BELL-CVE-2026-13346

Affected: Alpaquita:23: py3-pip, Alpaquita:25: py3-pip, Alpaquita:stream: py3-pip, BellSoft Hardened Containers:23: py3-pip, BellSoft Hardened Containers:25: py3-pip, BellSoft Hardened Containers:stream: py3-pip

BREW-azure-cli-CVE-2026-13346 — pip would incorrectly handle doubly-encoded package URLs from indexes

Affected: Homebrew: azure-cli

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.

This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

certfr-2026-avi-1249 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-1249

Withdrawn: CLEANSTART-2026-DK71595 — Security fixes in python3 3.11.15-r1

Withdrawn by the publisher.

Affected: CleanStart: python3

Package python3 version 3.11.15-r1 fixes 1 vulnerabilities: CVE-2026-13346

EUVD-2026-342541

fkie_cve-2026-13346

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.

GHSA-qwm4-qh6w-59xr — pip would incorrectly handle doubly-encoded package URLs from indexes

Affected: PyPI: pip

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.

msrc_CVE-2026-13346 — pip absolute path traversal during download from malicious package indexes

msrc_CVE-2026-13346

OESA-2026-3785 — python-pip security update

Affected: openEuler:20.03-LTS-SP4: python-pip

%changelog * Thu May 14 2026 markeryang &lt;747675909@qq.com&gt; - 23.3.1-11 - Fix CVE-2026-3219 Security Fix(es):

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.(CVE-2026-13346)

openSUSE-SU-2026:11451-1 — python311-pip-26.2-1.1 on GA media

python311-pip-26.2-1.1 on GA media

PYSEC-2026-3721

Affected: PyPI: pip

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.

RHSA-2026:48788 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation pip: pip: Arbitrary file installation via malicious package indexes

SUSE-SU-2026:23319-1 — Security update for python-pip

Security update for python-pip

UBUNTU-CVE-2026-13346

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: pipenv, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: pipenv, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:24.04:LTS: pipenv, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:26.04:LTS: pipenv and 1 more

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.