Source: python-pip Version: 26.1.2+dfsg-1 Severity: important Tags: security upstream Forwarded: https://github.com/pypa/pip/pull/14110 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for python-pip. CVE-2026-13346[0]: | pip would incorrectly handle doubly-encoded package URLs from | indexes allowing for files to be installed to arbitrary locations on | disk even when installing wheels. This vulnerability requires | downloading or installing a package from a malicious package index | to succeed, malicious packages alone are not able to exploit this | vulnerability. Note that this vulnerability only materially impacts | users running `pip download` with the `--only-binary` option as | installing source distributions from an untrusted index is already | an unsafe operation that executes code during install time. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-13346 https://www.cve.org/CVERecord?id=CVE-2026-13346 [1] https://mail.python.org/archives/list/[email protected]/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/ [2] https://github.com/pypa/pip/pull/14110 [3] https://github.com/pypa/pip/commit/10dfb6b9005484578b386f64b9f36982e3dc6679 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
