---
schema_version: '1.0'
id: security-20260711-a0d84f
url: https://osv.dev/vulnerability/GHSA-58qw-9mgm-455v
url_hash: a0d84ff16c87080632cfb08253a1778e6c77929bf17468d82a4b52697a198a73
canonical_url: https://osv.dev/vulnerability/GHSA-58qw-9mgm-455v
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-3219
- GHSA-58qw-9mgm-455v
- severity:CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- pip
- PyPI
lang: en
published_at: '2026-04-20T18:31:48Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:39:54Z'
status: published
content_hash: 7dcd83442eb1ecdfb2541760c7a2bf300b05ed853788f22ab8a516e080424fff
license_note: full
summary: pip has an interpretation conflict due to handling both concatenated tar
  and ZIP files as ZIP files
summary_source: rss
summary_en: pip has an interpretation conflict due to handling both concatenated tar
  and ZIP files as ZIP files
entities:
- name: PyTerrier retrieval pipelines
  type: data
- name: HashTag
  type: concept
- name: Structure and Interpretation of Computer Programs Course
  type: event
- name: Papa Fries 6 Cheese Fondue
  type: artifact
key_facts: []
related: []
related_auto:
- name: SustainableQuantumComputing
  type: concept
  weight: 3.0
- name: QueryExplorer
  type: system
  weight: 1.0
- name: MIT
  type: organization
  weight: 1.0
- name: HackerNews
  type: organization
  weight: 1.0
title: 'CVE-2026-3219: pip has an interpretation conflict due to handling both concatenated
  tar and ZIP files as ZIP files'
---

# CVE-2026-3219: pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

## TL;DR
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

## Key Points
- cve / CVE-2026-3219 / GHSA-58qw-9mgm-455v / severity:CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N / pip / PyPI

## Details
**Severity:** CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
**Advisory:** GHSA-58qw-9mgm-455v (CVE-2026-3219)

**Affected (your watchlist):**
- `PyPI:pip` 24.0 → fixed in 26.1 [docker/docker-portal+docker/local+docker/mac]
- `PyPI:pip` 25.0.1 → fixed in 26.1 [docker/docker-graphrag+docker/docker-llmwiki+docker/docker-portal+docker/docker-strands+docker/local+docker/mac]
- `PyPI:pip` 25.1.1 → fixed in 26.1 [docker/docker-mcp]
- `PyPI:pip` 26.0.1 → fixed in 26.1 [docker/docker-llmwiki]

**Details:**
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

**References:**
- https://nvd.nist.gov/vuln/detail/CVE-2026-3219
- https://github.com/pypa/pip/issues/13867
- https://github.com/pypa/pip/pull/13870
- https://github.com/pypa/pip
- https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ
- http://www.openwall.com/lists/oss-security/2026/04/20/8

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-58qw-9mgm-455v_

## Source
元記事: [CVE-2026-3219: pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files](https://osv.dev/vulnerability/GHSA-58qw-9mgm-455v) — published 2026-04-20T18:31:48Z