pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4061-1 advisory.

    Security issues fixed:

    - CVE-2026-13346: pip: arbitrary file installation via malicious package indexes (bsc#1273091).

    Non security issue fixed:

    - Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4030-1 advisory.

    This update for python313-pip fixes the following issue:

    - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to     be installed       to arbitrary locations on disk (bsc#1273090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4060-1 advisory.

    Security issues fixed:

    - CVE-2026-13346: arbitrary file installation via malicious package indexes (bsc#1273091).

    Non security issue fixed:

    - Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4174-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting     maliciously       crafted wheel archives (bsc#1274743).
    - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091     bsc#1273094).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issues fixed:

    - crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel,     openssh, libssh and       more packages (bsc#1211301).
    - Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d083cbcc1a advisory.

    Security fix for CVE-2026-13346

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-30b4eb25df advisory.

    Security fixes for CVE-2026-13346 and CVE-2026-8643

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-397c391da2 advisory.

    Security fixes for CVE-2026-13346 and CVE-2026-8643

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21643-1 advisory.

    This update for python-pip fixes the following issue:

    - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to     be installed       to arbitrary locations on disk (bsc#1273090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3588-1 advisory.

    This update for python3-pip fixes the following issue:

    - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to     be installed       to arbitrary locations on disk (bsc#1273090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3589-1 advisory.

    This update for python-pip fixes the following issue:

    - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to     be installed       to arbitrary locations on disk (bsc#1273090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-676dfc2776 advisory.

    Update to pip-26.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f7dddb6162 advisory.

    Update to pip-26.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed     to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or     installing a package from a malicious package index to succeed, malicious packages alone are not able to     exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip     download` with the `--only-binary` option as installing source distributions from an untrusted index is     already an unsafe operation that executes code during install time. (CVE-2026-13346)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348480	SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4061-1)	Nessus	SuSE Local Security Checks	Local	medium
348421	SUSE SLED15 / SLES15 Security Update : python313-pip (SUSE-SU-2026:4030-1)	Nessus	SuSE Local Security Checks	Local	medium
348418	SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:4060-1)	Nessus	SuSE Local Security Checks	Local	medium
346216	SUSE SLES15: libpython3_9-1_0 / python39 / python39-base / python39-curses / etc (SUSE-SU-2026:4174-1)	Nessus	SuSE Local Security Checks	Local	high
344865	Fedora 45 : python-pip (2026-d083cbcc1a)	Nessus	Fedora Local Security Checks	Local	medium
342754	Fedora 43 : python-pip (2026-30b4eb25df)	Nessus	Fedora Local Security Checks	Local	medium
341808	Fedora 44 : python-pip (2026-397c391da2)	Nessus	Fedora Local Security Checks	Local	medium
341178	openSUSE 16 Security Update : python-pip (openSUSE-SU-2026:21643-1)	Nessus	SuSE Local Security Checks	Local	medium
335088	SUSE SLED15 / SLES15 Security Update : python3-pip (SUSE-SU-2026:3588-1)	Nessus	SuSE Local Security Checks	Local	medium
335074	SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2026:3589-1)	Nessus	SuSE Local Security Checks	Local	medium
334456	Fedora 44 : mingw-python-pip (2026-676dfc2776)	Nessus	Fedora Local Security Checks	Local	medium
334446	Fedora 43 : mingw-python-pip (2026-f7dddb6162)	Nessus	Fedora Local Security Checks	Local	medium
330733	Linux Distros Unpatched Vulnerability : CVE-2026-13346	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-13346

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium