Search: CVE-2026-3219

CVE-2026-3219 is a medium severity vulnerability in the Python Packaging Authority's pip tool. The issue arises because pip treats concatenated tar and ZIP files as ZIP files regardless of the filename or whether the file is both a tar and ZIP archive. This can cause confusing installation behavior, such as installing files that do not match the archive's filename. The updated behavior requires the file to uniquely identify as either a ZIP or tar archive before proceeding with installation.