CVE-2026-113717Low· 2.3▾ TwilightPoC availablevirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configure…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 12.6 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.
virtualenv < 21.14.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113714Low· 2.3virtualenv: Downloaded wheel selection and caching precede verification
CVE-2026-113716Medium· 4.5virtualenv: Builtin creation follows linked environment directories
CVE-2026-113719Medium· 4.5virtualenv: Seed replacement does not contain metadata deletion paths
CVE-2026-113715Low· 2.0virtualenv: Venv configuration readback can reinterpret path boundaries
CVE-2026-113718High· 7.1virtualenv: Xonsh activation literals depend on the script decoding codec
CVE-2026-113720Medium· 4.4virtualenv: Seeded files retain permissions from an older cache