PT-2026-118615

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The download wheel function writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from the textual Saved output of pip. When...

PT-2026-105772

download wheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLE SHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or th...

PT-2026-102924

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.12 Description The download wheel function fails to verify the bytes of pip and setuptools seed wheels fetched during periodic updates or via the --download option against an authoritative digest, unlike the...