Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-113717virtualenv: Pip seeding with download omits wheel digest verification

Low 2.3

In plain English

A low-severity security flaw in virtualenv from pypa. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113717
Debian:13	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113717
Debian:14	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113717
PyPI	virtualenv	21.14.9	GHSA-cx28-75q4-x26q
Ubuntu:26.04:LTS	python-virtualenv	no fix listed	UBUNTU-CVE-2026-113717
Ubuntu:26.10	python-virtualenv	no fix listed	UBUNTU-CVE-2026-113717

Affected products (as reported)

Vendor	Product	Versions
pypa	virtualenv	< 21.14.9

Weakness: CWE-494 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q x_refsource_CONFIRM
https://github.com/pypa/virtualenv/pull/3430 x_refsource_MISC
https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96 x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.9 x_refsource_MISC