pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-30b4eb25df advisory.

    Security fixes for CVE-2026-13346 and CVE-2026-8643

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-397c391da2 advisory.

    Security fixes for CVE-2026-13346 and CVE-2026-8643

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21643-1 advisory.

    This update for python-pip fixes the following issue:

    - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to     be installed       to arbitrary locations on disk (bsc#1273090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3588-1 advisory.

    This update for python3-pip fixes the following issue:

    - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to     be installed       to arbitrary locations on disk (bsc#1273090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3589-1 advisory.

    This update for python-pip fixes the following issue:

    - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to     be installed       to arbitrary locations on disk (bsc#1273090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-676dfc2776 advisory.

    Update to pip-26.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f7dddb6162 advisory.

    Update to pip-26.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed     to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or     installing a package from a malicious package index to succeed, malicious packages alone are not able to     exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip     download` with the `--only-binary` option as installing source distributions from an untrusted index is     already an unsafe operation that executes code during install time. (CVE-2026-13346)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342754	Fedora 43 : python-pip (2026-30b4eb25df)	Nessus	Fedora Local Security Checks	Local	medium
341808	Fedora 44 : python-pip (2026-397c391da2)	Nessus	Fedora Local Security Checks	Local	medium
341178	openSUSE 16 Security Update : python-pip (openSUSE-SU-2026:21643-1)	Nessus	SuSE Local Security Checks	Local	medium
335088	SUSE SLED15 / SLES15 Security Update : python3-pip (SUSE-SU-2026:3588-1)	Nessus	SuSE Local Security Checks	Local	medium
335074	SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2026:3589-1)	Nessus	SuSE Local Security Checks	Local	medium
334456	Fedora 44 : mingw-python-pip (2026-676dfc2776)	Nessus	Fedora Local Security Checks	Local	medium
334446	Fedora 43 : mingw-python-pip (2026-f7dddb6162)	Nessus	Fedora Local Security Checks	Local	medium
330733	Linux Distros Unpatched Vulnerability : CVE-2026-13346	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-13346

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium