CVE-2026-113717

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113717 virtualenv: Pip seeding with download omits wheel digest verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716

The virtualenv tool, prior to version 21.14.9 , is vulnerable to a symlink following issue during builtin environment creation. The ensure_dir() function improperly follows existing symlinks for executable, library, and package directories. If a local attacker prepares a tree containing a symlink...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

DEBIAN-CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

DEBIAN-CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113714 virtualenv: Downloaded wheel selection and caching precede verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714 virtualenv: Downloaded wheel selection and caching precede verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

Resources Downloaded over Insecure Protocol

Overview Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol via the seed wheel acquisition logic in src/virtualenv/seed/wheels/acquire.py and pipinvoke.py, where wheels are cached and later reused without verifying their integrity before being passed t...

CVE-2026-113714

The virtualenv tool, versions 21.14.8 through 21.14.9 , contains a vulnerability in the download_wheel() function. The root cause is that downloaded package-index data is written directly into the reusable wheel/house cache before the verification target is selected from pip's textual output. If ...

CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

The virtualenv tool, used for creating isolated Python environments, is vulnerable in versions 21.14.8 through 21.14.10 . The app-data seeder can leave an environment linked to temporary package files that are deleted upon completion of the creation process. This occurs because the environment-va...