CVE-2026-113717: virtualenv: Pip seeding with download omits wheel digest verification
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd() handles --seeder pip --download by calling getwheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel() and verifywheeldigest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virtualenvto a version that resolves this vulnerability.Fixed in 21.14.9
Event History
Frequently Asked Questions
Which deployments are affected by this verification bypass?
The affected path is virtualenv versions before 21.14.9 when creating an environment with the pip seeder and the --download option. It applies where the default-index PyPI digest-comparison policy remains enabled; explicit custom-index settings already opt out of that comparison and are outside this claim.
What does an attacker need to exploit this condition?
An attacker would need an index candidate that matches the bundled package and version so pip can select it. The issue does not by itself defeat TLS or give an attacker control of index responses, and exploitation also requires the --seeder pip --download workflow.
How can I determine whether I may have been exposed?
Review environment creation commands and automation for use of --seeder pip --download on virtualenv versions earlier than 21.14.9. Also determine whether index environment variables were unset while the default-index PyPI digest-comparison policy was active.
What should be done if affected?
Upgrade virtualenv to version 21.14.9, which fixes the issue. Until then, avoid the affected pip-seeding download workflow where possible.