CVE-2026-3219
MEDIUMpip doesn't reject concatenated ZIP and tar archives
Title source: cnaDescription
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
References (3)
Core 3
Core References
Patch patch
https://github.com/pypa/pip/pull/13870
Vendor Advisory vendor-advisory
https://mail.python.org/archives/list/[email protected]/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ/
Scores
CVSS v4
4.6
EPSS
0.0014
EPSS Percentile
4.0%
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-434
Status
published
Products (2)
pypi/pip
0 - 26.1PyPI
Python Packaging Authority/pip
< 26.1
Published
Apr 20, 2026
Tracked Since
Apr 20, 2026