pip CVE-2026-13346

pip's Link.filename property in src/pip/_internal/models/link.py applied urllib.parse.unquote() to a URL path segment that was already partially decoded during standard URL parsing, producing a second decoding pass. A malicious PyPI-compatible index could serve wheel URLs containing doubly-percent-encoded path separators - for example, %252F (encoding of %2F) survives the first decode as %2F but resolves to a literal / after the second unquote() call. The resulting filename, now containing embedded slashes or .. components, was passed directly to os.path.join(location, filename) in download.py, causing the file to be written outside the intended download directory. The upstream fix (PR #14110) introduces a PathComponent newtype with a _to_path_component() sanitizer using os.path.basename() for strict reduction to a single path component, and a join_within_directory() function that enforces containment at the type level, preventing the value from escaping the target directory. Affected product CPE: cpe:2.3:a:python_packaging_authority:pip:*:*:*:*:*:*:*:*. Root cause class is CWE-36 (Absolute Path Traversal).