What’s Vulnerable › Vulnerabilities

CVE-2026-3219: pip doesn't reject concatenated ZIP and tar archives

• Severity: medium (CVSS 4.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-20 · updated 2026-10-26
• Weakness: CWE-434

Description

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

Affected products

• Pypi Pip: before 26.1; 0.2, 0.2.1, 0.3, 0.3.1, 0.4, 0.5 (+148) — fixed in 26.1
• Python Packaging Authority pip: before 26.1 — fixed in 26.1

How to fix

Upgrade to a fixed version: Pypi Pip 26.1; Python Packaging Authority pip 26.1. Check the vendor advisory for mitigations.

References

• https://github.com/pypa/pip/pull/13870
• https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ/
• http://www.openwall.com/lists/oss-security/2026/04/20/8

Get alerted when CVE-2026-3219 or the next vulnerability affects your stack