CVE-2026-13346
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
29/07/2026
Última modificación:
30/07/2026
Descripción
*** Pendiente de traducción *** pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.<br />
<br />
<br />
<br />
<br />
This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Impacto
Puntuación base 4.0
5.60
Gravedad 4.0
MEDIA