pip treats concatenated tar and ZIP archives as ZIP regardless of the filename or whether the file is simultaneously a tar and ZIP archive. This misclassification can cause installing incorrect or unintended files, leading to confusing or incorrect package behavior.

The vulnerability affects the Python Packaging Authority’s pip tool. No specific version information is provided, so all unpatched pip releases prior to the fix are potentially affected.

The CVSS score of 4.6 indicates a moderate impact. The vulnerability is not listed in CISA KEV. The likely attack vector requires an attacker to provide a malicious archive to pip during installation, which could result in malformed or unwanted files being installed but does not directly lead to arbitrary code execution. The risk remains moderate and should be mitigated by updating pip to a version that handles concatenated archives correctly.