CVE-2026-13346: pip Path Traversal Vulnerability

CVE-2026-13346 Overview

CVE-2026-13346 is a path traversal vulnerability in pip, the Python package installer. The flaw stems from improper handling of doubly-encoded package URLs returned by package indexes. An attacker who controls or compromises a package index can craft responses that cause pip to write files to arbitrary locations on disk, even when the user restricts installation to wheels. The vulnerability maps to [CWE-36: Absolute Path Traversal]. Exploitation requires the victim to download or install a package from a malicious index; malicious packages alone cannot trigger the flaw. The issue materially affects users running pip download with the --only-binary option, since installing source distributions from untrusted indexes is already unsafe.

Critical Impact
A malicious package index can cause pip to place files outside the intended target directory, enabling tampering with system or user files during wheel downloads.

Affected Products

pip (Python Package Installer) — versions prior to the fix in pypa/pip PR #14110
Workflows using pip download --only-binary
Environments configured to fetch packages from untrusted or attacker-controlled indexes

Discovery Timeline

2026-07-29 - CVE-2026-13346 published to NVD
2026-07-29 - Coordinated disclosure via Python Security Announcement and Openwall OSS-Security
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-13346

Vulnerability Analysis

The vulnerability arises from how pip decodes URLs returned by package indexes. Package indexes communicate download locations through URLs that include percent-encoded characters. When those URLs are doubly encoded, pip decodes them more than once, converting sequences such as %252e%252e%252f into ../. The decoded path is then joined with the download destination without proper containment checks, allowing directory traversal outside the intended target directory.

Because the flaw resides in URL and path handling logic rather than in package payloads, the --only-binary option provides no protection. Downloading a wheel is sufficient to trigger the write primitive. The result is arbitrary file placement with the privileges of the invoking user.

Root Cause

The root cause is missing normalization and containment validation after URL decoding. pip trusts the index-supplied filename component when constructing the on-disk write path. The correction, published in pypa/pip PR #14110, enforces stricter parsing and rejects paths that resolve outside the destination directory.

Attack Vector

Exploitation requires an attacker to control the package index that a victim queries. This can occur through a malicious mirror, a compromised private index, dependency confusion against internal index names, or a network-position attack against non-TLS index traffic. When the victim runs pip download --only-binary=:all: <package> against the malicious index, the crafted URL causes files to be written outside the download directory. The attack requires user action and elevated context to reach sensitive paths, which is reflected in the high attack complexity of the CVSS vector.

No verified public proof-of-concept code is available. Technical details are provided in the upstream fix.

Detection Methods for CVE-2026-13346

Indicators of Compromise

Unexpected files written outside the working directory during or after a pip download or pip install invocation
HTTP responses from a package index containing filenames with %25 sequences (indicative of double encoding) followed by traversal characters
pip operations against non-standard index URLs configured via --index-url, --extra-index-url, or PIP_INDEX_URL

Detection Strategies

Inspect proxy or endpoint telemetry for pip fetches whose response bodies reference filenames containing %2e%2e, %252e, or encoded path separators
Audit CI/CD build logs for pip download --only-binary output that lists destination paths outside the configured directory
Correlate process telemetry linking a pip process to file writes under /etc, ~/.ssh, ~/.bashrc, site-packages, or other paths outside the expected download target

Monitoring Recommendations

Baseline the set of package indexes used by developers and build systems, and alert on deviations
Log all outbound connections from build agents to package index hosts and inspect for non-approved mirrors
Track file creation events initiated by pip, python, and CI runner processes for writes to sensitive filesystem locations

How to Mitigate CVE-2026-13346

Immediate Actions Required

Upgrade pip to a version containing the fix from pypa/pip PR #14110
Restrict pip to trusted indexes only, and remove unused --extra-index-url entries
Pin index URLs to HTTPS endpoints and validate certificates on all build systems
Audit recent pip download --only-binary operations for unexpected file writes outside the target directory

Patch Information

The fix is delivered upstream in pypa/pip PR #14110 and announced via the Python Security Announcement thread. Update pip using python -m pip install --upgrade pip from a trusted index once the patched release is available. Rebuild container base images and CI runners to embed the fixed version.

Workarounds

Avoid pip download and pip install against untrusted or unauthenticated package indexes until the patched version is deployed
Use a curated internal mirror (for example, devpi or Artifactory) that validates upstream package metadata
Execute pip operations inside ephemeral sandboxes or containers with no write access to sensitive host paths
Enforce --require-hashes and hash-pinned requirement files to reject unexpected artifacts

bash

# Configuration example: restrict pip to a single trusted index and enforce hashes
python -m pip install --upgrade pip
pip config set global.index-url https://internal-mirror.example.com/simple/
pip config set global.trusted-host internal-mirror.example.com
pip install --require-hashes -r requirements.txt