Red Hat Security Advisory

RHSA-2026:48788

Red Hat Hardened Images RPMs Security Update

Released 2026-07-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images python-pip-26.2-0.1.hum1@src, python-pip-wheel-26.2-0.1.hum1@noarch@public-hummingbird-aarch64-rpms, python-pip-wheel-26.2-0.1.hum1@noarch@public-hummingbird-x86_64-rpms +2

Fixes 2 records

TI-2026-11308 CVE-2026-13346 · GHSA-qwm4-qh6w-59xr

pip absolute path traversal during download from malicious package indexes

LOW 25

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.

CVSS 4.0MEDIUM 5.6 Network High privileges User interaction EPSS 0.00292 Published 2026-07-29 Partial fix · 26.2, 26.2.0 CWE-36

TI-2026-05576 CVE-2026-6357 · GHSA-jp4c-xjxw-mgf9

pip self-update functionality can import newly installed modules after wheel installation

LOW 23

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names.

CVSS 4.0MEDIUM 5.3 Local High privileges User interaction EPSS 0.00138 Published 2026-04-27 Partial fix · 26.1 CWE-829