TI-2026-02782 CVE-2026-3219 · GHSA-58qw-9mgm-455v
pip doesn't reject concatenated ZIP and tar archives
Priority LOW 20
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file.
Vulnerabilities
3 records
TI-2026-01386 CVE-2026-1703 · GHSA-6vgw-5pg2-w6jp
Limited path traversal when installing wheel archives
Priority LOW 11
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory.
TI-2025-08119 CVE-2025-8869 · GHSA-4xh5-x5gv-qwph
Fallback tar extraction in pip doesn't check symbolic links point to extraction directory
Priority LOW 27
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.