GHSA-58qw-9mgm-455v

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-3219

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pip	< 26.1	26.1

Details

As written in the advisory (Markdown source, shown as plain text).

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-3219 advisory
https://github.com/pypa/pip/issues/13867 web
https://github.com/pypa/pip/pull/13870 web
https://github.com/pypa/pip package
https://mail.python.org/archives/list/[email protected]/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ web
http://www.openwall.com/lists/oss-security/2026/04/20/8 web