Executive brief
A vulnerability in the Python package manager (pip) allows for an interpretation conflict when handling specially crafted archive files. An attacker could create a file that appears to be one type of archive (like a .tar file) but is processed as another (like a .zip file), potentially leading to the installation of unintended or malicious code. This could compromise the integrity of software environments and automated deployment pipelines.
Technical details
pip versions up to 26.0.1 are vulnerable to an interpretation conflict (polyglot file attack) where concatenated tar and ZIP files are processed exclusively as ZIP files. This occurs regardless of the file extension or the presence of tar headers. An attacker can exploit this by providing a malicious archive that pip misinterprets, leading to the installation of files that do not match the intended archive content. The fix, introduced in version 26.1, ensures that pip only proceeds with installation if the file identifies uniquely as either a ZIP or a tar archive, but not both. Exploitation requires local access and user interaction to initiate the installation of the crafted file.
Affected products
- PyPA pip <= 26.0.1
Timeline
- 2026-04-20: disclosed
- 2026-04-20: advisory
- 2026-04-20: patched: Fixed in version 26.1
References
- https://api.github.com/users/amine-malloul-gira
- https://github.com/amine-malloul-gira
- https://api.github.com/users/amine-malloul-gira/gists%7B/gist_id%7D
- https://api.github.com/users/amine-malloul-gira/repos
- https://avatars.githubusercontent.com/u/183485345?v=4
- https://api.github.com/users/amine-malloul-gira/events%7B/privacy%7D