CVE-2026-3219

pip doesn't reject concatenated ZIP and tar archives

CVSS 4.6 MEDIUMEPSS 0.1%CWE-434

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 4.6EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

20 abr 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

Python Packaging Authority · pip

Referencias

https://github.com/pypa/pip/pull/13870 https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ/http://www.openwall.com/lists/oss-security/2026/04/20/8