CVE-2026-13346 is a vulnerability in python-pip where the software incorrectly processes doubly-encoded package URLs from malicious package indexes. This flaw allows a remote attacker to convince a user to download or install a package that results in files being installed to arbitrary locations on the system. The vulnerability mainly impacts users who use the pip download command with the --only-binary option. The flaw involves improper limitation of a pathname to a restricted directory (CWE-22, CWE-36). Red Hat has issued a security update fixing this issue in python-pip packages. The vulnerability has a medium severity rating and no known exploits in the wild have been reported.

An attacker can exploit this vulnerability by hosting a malicious package index with doubly-encoded URLs, causing pip to install files to arbitrary locations on disk. This can lead to overwriting or creating critical files, potentially resulting in system compromise, unauthorized code execution, or bypassing security mechanisms. The vulnerability affects the integrity and confidentiality of the system and may also impact availability if critical files are corrupted or deleted. It primarily affects users running pip download with the --only-binary option; installing source distributions from untrusted indexes is already unsafe.

A patch is available and should be applied to affected python-pip packages. Red Hat and other vendors have released updates that fix this vulnerability. Users should update to the fixed versions as soon as possible. No additional mitigations are specifically recommended beyond applying the official fix. Users not using the --only-binary option are less impacted, but updating remains advised.