Repository navigation
Update bundled pip to 26.1 to fix CVE-2026-3219 vulnerability #149148
Description
Feature or enhancement
Python 3.15 ensurepip bundles pip 26.0.1 which has CVE-2026-3219 vulnerability:
A flaw was found in pip. This vulnerability occurs because pip incorrectly processes concatenated tar and ZIP files as ZIP files, regardless of their true format. This improper handling can lead to confusing installation behavior, potentially causing the installation of unintended or 'incorrect' files. This could allow an attacker to influence the installation process by providing a specially crafted archive.
Would it be possible update pip to 26.1 in ensurepip?
See issue gh-144538 for the previous pip update.
Activity
[-]Update bundled pip to 26.1 to get security fixes[/-][+]Update bundled pip to 26.1 to fix CVE-2026-3219 vulnerability[/+]hugovk commentedon Apr 29, 2026
Yes, it's the last step of the pip release process, and usually happens once they're confident the release went out smoothly and didn't need a patch release.
pip RM (for this release) @sbidoul will be doing it: pypa/pip#13795 (comment), we can use this issue for the PR.
sbidoul commentedon Apr 29, 2026
Does it work for you if I do that this weekend?
vstinner commentedon Apr 29, 2026
Ok, good!
Oh, I already created PR gh-149150 before seeing your message. Feel free to close my PR if you prefer to create a new one.
sbidoul commentedon Apr 29, 2026
Ah, perfect then, thanks!
gh-149148: Upgrade bundled pip to 26.1 (#149150)
[3.13] gh-149148: Upgrade bundled pip to 26.1 (GH-149150) (#149155)
[3.14] gh-149148: Upgrade bundled pip to 26.1 (GH-149150) (#149154)
hugovk commentedon Apr 29, 2026
Thanks all!
mcepl commentedon Sep 2, 2026
Will this (upgrade of embedded wheels) be ever backported to 3.11 and 3.12? “As needed” doesn’t give much certain expectations.
hugovk commentedon Sep 3, 2026
No, we generally don't backport bundled wheels to source-only security updates.
See #131860 (comment).