{"action":"Upgrade pip to 26.2 or later.","affected":[{"fixed":"26.2","introduced":"0"}],"component":"pip","cve_ids":["CVE-2026-13346"],"ecosystem":"PyPI","epss":0.00292,"exploited":false,"fixed_versions":["26.2"],"ghsa_id":"GHSA-qwm4-qh6w-59xr","id":"tcs_01M5KH6Z4GK71PARP6M9H7933Z","modified_at":"2026-09-10T11:15:08.939447160Z","published_at":"2026-07-29T19:16:44.267Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3721","http://www.openwall.com/lists/oss-security/2026/07/29/7","https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/","https://github.com/pypa/pip/pull/14110","https://github.com/advisories/GHSA-qwm4-qh6w-59xr"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-3721","url":"https://osv.dev/vulnerability/PYSEC-2026-3721"}],"summary":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels."}