Python Packaging Authority vulnerabilities

Products

• pip 1

Latest Python Packaging Authority CVEs

Newest publication first

1. CVE-2026-13346 pip absolute path traversal during download from malicious package indexes

   Published 2026-07-29

   Medium·CVSS 5.6

   pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, maliciou...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.