Hi,

The following vulnerability was published for python-pip.

CVE-2026-13346[0]:
| pip would incorrectly handle doubly-encoded package URLs from
| indexes allowing for files to be installed to arbitrary locations on
| disk even when installing wheels.     This vulnerability requires
| downloading or installing a package from a malicious package index
| to succeed, malicious packages alone are not able to exploit this
| vulnerability. Note that this vulnerability only materially impacts
| users running `pip download` with the `--only-binary` option as
| installing source distributions from an untrusted index is already
| an unsafe operation that executes code during install time.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-13346
https://www.cve.org/CVERecord?id=CVE-2026-13346
[1] https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/
[2] https://github.com/pypa/pip/pull/14110
[3] https://github.com/pypa/pip/commit/10dfb6b9005484578b386f64b9f36982e3dc6679

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
python-pip, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143072@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefano Rivera <stefanor@debian.org> (supplier of updated python-pip package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 21 Oct 2026 16:04:45 +0200
Source: python-pip
Architecture: source
Version: 26.2.2+dfsg-1
Distribution: unstable
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Stefano Rivera <stefanor@debian.org>
Closes: 1143072
Changes:
 python-pip (26.2.2+dfsg-1) unstable; urgency=high
 .
   * New upstream release.
     - Note that while this version contains a critical certifi security update
       upstream, for Debian this is completely delegated to ca-certificates.
     - CVE-2026-13346: Correctly handle handle doubly-encoded package URLs
       (Closes: #1143072)
   * Refresh patches.
   * Update copyright.
Checksums-Sha1:
 591d8d724755881751ffd05c86be4a2bb85732e1 1886 python-pip_26.2.2+dfsg-1.dsc
 e334b52b5ea083298412ddb380943b7bb4a3ddbb 1125652 python-pip_26.2.2+dfsg.orig.tar.xz
 592ad80d42160a26255c8240bf92e66c0ab1e9e6 22292 python-pip_26.2.2+dfsg-1.debian.tar.xz
 a84988b08fb5bbf3331acb663b0ff08693dab3af 6723 python-pip_26.2.2+dfsg-1_source.buildinfo
Checksums-Sha256:
 def5892d58b789b1af8b0d19f3950572dcf0a1828d8099618dce6d63f5985ffd 1886 python-pip_26.2.2+dfsg-1.dsc
 cc0ccba40ecab7ca43aafde6767658a9841b6625f56b9fef4a49327e5dde7693 1125652 python-pip_26.2.2+dfsg.orig.tar.xz
 54611909c64c392f63768cacfe79b03c9313240a3ea39026430bf069d22301f6 22292 python-pip_26.2.2+dfsg-1.debian.tar.xz
 10d43bb3fd2d701cc504091f31c846d431f5e543b9f11bb15e79ac2a3f5c6e56 6723 python-pip_26.2.2+dfsg-1_source.buildinfo
Files:
 4d44e0195d3426b360363bf22cb5e15f 1886 python optional python-pip_26.2.2+dfsg-1.dsc
 e55c1bfeac5d0f5dee9fa2aa95051581 1125652 python optional python-pip_26.2.2+dfsg.orig.tar.xz
 17d6b7a117b22c23d47e7419c8743326 22292 python optional python-pip_26.2.2+dfsg-1.debian.tar.xz
 94e0e30ffa943297dd110ad3fef5ffca 6723 python optional python-pip_26.2.2+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iIoEARYKADIWIQTumtb5BSD6EfafSCRHew2wJjpU2AUCatkceBQcc3RlZmFub3JA
ZGViaWFuLm9yZwAKCRBHew2wJjpU2JKuAP4j62i1RojNPe4DnJDPz5D6mrSd7gna
Z8FeYpFGtnEYfQEA7Ih1YJ9WLE4QKoTTJK9BUAmljaoDI0tNblrJXtoO9g4=
=Sg+M
-----END PGP SIGNATURE-----