CVE-2026-102930: virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLESHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIPINDEXURL, PIPEXTRAINDEXURL, or PIPINDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virtualenvto a version that resolves this vulnerability.Fixed in 21.7.12
Event History
Frequently Asked Questions
Which deployments are exposed to the unverified download path?
Deployments using virtualenv versions earlier than 21.7.12 are exposed when they obtain pip or setuptools seed wheels through periodic updates or the --download option. A substituted wheel can be cached and then used to seed later virtual environments.
What would an attacker need to exploit this issue?
An attacker would need the ability to substitute a wheel obtained from the package source, such as through a compromised index, a stale mirror, or an intercepted TLS connection. The replacement must be served under the requested distribution, version, and filename.
Are custom package indexes protected by the new digest verification?
No. Digest verification is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX is configured, because custom indexes may publish rebuilt wheels.
What is the remediation?
Upgrade virtualenv to version 21.7.12 or later. If immediate upgrading is not possible, avoid fetching seed wheels through periodic updates or the --download option and review cached seed wheels, since cached substituted wheels may be used for subsequently created environments.