CVE-2026-3219: pip doesn't reject concatenated ZIP and tar archives
pip doesn't reject concatenated ZIP and tar archives
Other sources
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.36.1-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.2-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.36.1-4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.2-7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3219?
CVE-2026-3219 is classified as a moderate severity vulnerability due to the risk of incorrect file installations.
How do I fix CVE-2026-3219?
To mitigate CVE-2026-3219, ensure that you are using the latest version of pip where this issue has been addressed.
What versions of pip are affected by CVE-2026-3219?
CVE-2026-3219 affects multiple versions of pip that allow processing of concatenated ZIP and tar files.
What potential impact does CVE-2026-3219 have on users?
The impact of CVE-2026-3219 could lead users to install unintended or incorrect files from concatenated archives.
Is there any workaround for CVE-2026-3219 until it is fixed?
As a workaround for CVE-2026-3219, carefully review and validate files in archives before installation.