AIKIDO-2026-982477

TL;DR

pip decodes the URL path twice when determining a link's filename from a package index. A package index can supply a doubly-encoded URL whose decoded filename is treated as an absolute or traversing path, so downloaded files are written to arbitrary locations on disk, even when installing wheels. This lets a malicious index place files outside the intended download or install directory. The fix stops the redundant decoding and treats the derived filename as a single path component.