CVE-2026-113717

The virtualenv tool for creating isolated Python environments is vulnerable to a digest verification bypass in versions prior to 21.14.9 . The root cause lies in the PipInvoke.get_pip_install_cmd() function, which handles --seeder pip --download by calling get_wheel(download=False). This allows p...

CVE-2026-113717 virtualenv: Pip seeding with download omits wheel digest verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...