CVE-2026-3219: 
Python vulnerability analysis and mitigation

CVE-2026-3219 is an archive type confusion vulnerability in pip, the Python package installer, where pip incorrectly handles files that are simultaneously valid tar and ZIP archives (polyglot files), always treating them as ZIP files regardless of filename or actual format. This behavior can result in pip installing unintended or "incorrect" files from a malicious archive. The vulnerability affects all pip versions up to and including 26.0.1, and was fixed in pip 26.1. It was disclosed on April 20, 2026, via the Python security-announce mailing list and the GitHub Advisory Database, with a CVSS v4.0 base score of 4.6 (Medium) (GitHub Advisory, oss-security).

The root cause is an improper archive format detection logic in pip's unpacking code (CWE-434: Unrestricted Upload of File with Dangerous Type). Prior to the fix, pip ran all ZIP checks first (content type, filename, magic signature via zipfile.is_zipfile), and if any matched, it would unzip the archive — without checking whether the file was also a valid tar archive. Because zipfile.is_zipfile can return a false positive on concatenated tar+ZIP polyglot files, a .tar.gz-named file could be silently treated as a ZIP and have its ZIP contents installed instead of its tar contents. The fix (merged in pip PR #13870) refactors the detection order to prioritize content-type and filename checks, and only falls back to magic signature detection if the result is unambiguous (i.e., the file is identified as either ZIP or tar, but not both). Exploitation requires local access and active user interaction — a user must initiate the installation of a crafted malicious archive (GitHub Advisory, pip PR #13870).

Successful exploitation could allow an attacker to cause pip to install unintended or malicious package contents that differ from what the archive filename implies, compromising the integrity of the installed Python environment. There is no confidentiality or availability impact; the vulnerability is limited to a low integrity impact on the vulnerable system. In a supply chain attack scenario, a malicious actor could craft a polyglot archive and trick a user into installing it, potentially leading to execution of malicious code if the installed files include scripts or entry points (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.013–0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that a user actively initiates installation of a specially crafted polyglot archive, limiting the attack surface significantly (GitHub Advisory, oss-security).

1. Craft a polyglot archive: Create a file that is simultaneously a valid tar archive and a valid ZIP archive (a tar+ZIP polyglot). The tar portion contains legitimate-looking files matching the expected package, while the ZIP portion contains malicious or unintended files.
2. Name the archive deceptively: Name the file with a .tar.gz or .whl extension to suggest it is a tar or wheel archive, while the ZIP content contains the attacker's payload.
3. Distribute the archive: Host the malicious archive on a package index, file share, or deliver it via social engineering to a target user.
4. Induce user installation: Trick the target user into running pip install <malicious-archive> against the crafted file (e.g., via a direct URL, local path, or compromised package index).
5. Achieve unintended installation: pip (versions ≤ 26.0.1) detects the file as a ZIP due to the zipfile.is_zipfile false positive and installs the ZIP contents instead of the tar contents, placing attacker-controlled files into the Python environment (pip PR #13870, GitHub Advisory).

• File System: Presence of unexpected files in site-packages or other pip installation directories that do not match the expected contents of the installed package; archive files with .tar.gz or .whl extensions that are also valid ZIP files (detectable with both tarfile.is_tarfile() and zipfile.is_zipfile() returning True).
• Logs: pip installation logs showing packages installed from local or unusual archive paths; pip output indicating installation from a .tar.gz file where ZIP-format contents were extracted.
• Process: Unexpected scripts or entry points registered in the Python environment following a pip install operation; post-install scripts executing from newly installed packages with unusual names or origins.

The primary remediation is to upgrade pip to version 26.1 or later, which contains the fix that rejects ambiguous archives identified as both tar and ZIP (GitHub Advisory, pip PR #13870). Users can upgrade pip by running pip install --upgrade pip. As a workaround prior to upgrading, use --require-hashes when installing packages to ensure archive integrity, and avoid installing packages from untrusted or unverified sources. Note that PyPI's backend (Warehouse) already rejects polyglot archive uploads, so packages installed directly from PyPI are not affected by this attack vector (pip PR #13870).

The vulnerability was independently reported to the Python Security Response Team by Google and was also discovered and fixed by community contributor f3flight via pip PR #13870. pip maintainer notatallshaw noted the independent Google report and thanked the community contributor for the fix. The Python security team (Seth Larson) issued a formal announcement to the security-announce@python.org mailing list on April 20, 2026. Community reaction was generally measured given the low severity and limited exploitability; multiple open-source projects added temporary --ignore-vuln CVE-2026-3219 flags to their CI pipelines while awaiting the pip 26.1 release. A related PyPI blog post from August 2025 on ZIP parser confusion attacks was referenced in community discussions as relevant background (pip PR #13870, oss-security).