CVE-2026-3219

Name of the Vulnerable Software and Affected Versions pip (affected versions not specified)

Description pip processes concatenated tar and ZIP files exclusively as ZIP files, ignoring the filename or the fact that the file contains both archive types. This behavior can lead to the installation of incorrect files based on the archive's filename.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.