---
id: CVE-2026-113717
title: 'virtualenv: Pip seeding with download omits wheel digest verification'
summary: >-
  virtualenv is a tool for creating isolated virtual python environments. Prior
  to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by
  calling get_wheel(download=False) and then allowing pip to consult the
  configure…
severity: low
cvss: 2.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-494
vendor: pypa
product: virtualenv
affected:
  - virtualenv < 21.14.9
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T19:32:38.243331Z'
exploitAvailable: true
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T19:32:57.649Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113717'
references:
  - url: 'https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q'
    label: 'https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q'
  - url: 'https://github.com/pypa/virtualenv/pull/3430'
    label: 'https://github.com/pypa/virtualenv/pull/3430'
  - url: >-
      https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96
    label: >-
      https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96
  - url: 'https://github.com/pypa/virtualenv/releases/tag/21.14.9'
    label: 'https://github.com/pypa/virtualenv/releases/tag/21.14.9'
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-20T20:18:14.535Z'
---

## Overview

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.

## Affected

- `virtualenv < 21.14.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.