pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 20, 2026 · NIST NVD

   Detected

   pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

2. Jun 17, 2026 · NIST NVD

   Updated

   pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

Sources

• CVE.orgVulnerability recordCVE-2026-3219

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-3219

  pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior

  nvd.nist.gov

References

• Reference · openwall.com
• Reference · github.com
• Reference · mail.python.org