CVE-2026-13346

Name of the Vulnerable Software and Affected Versions openSUSE Tumbleweed python311-pip versions prior to 26.2-1.1

Description pip incorrectly handles doubly-encoded package URLs from indexes. This allows files to be installed to arbitrary locations on disk, even when installing wheels (pre-compiled binary packages). This issue requires the user to download or install a package from a malicious package index. It primarily impacts users running pip download with the --only-binary option, as installing source distributions from untrusted indexes is already considered unsafe due to code execution during installation.

Recommendations Update python311-pip to version 26.2-1.1.