Cloudanix VulnDB

CVE-2026-113717

None

CVSS

—

EPSS

0.3%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

An older version of a Python tool could let the wrong software packages slip into new coding environments without proper checks.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Data Tampering
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Bypasses virtualenv's wheel digest verification for pip seeder downloads when using default PyPI index, allowing pip to fetch packages from configured index without SHA-256 comparison to PyPI metadata.

Why it matters to the business

Organizations using older virtualenv versions risk installing unverified Python packages during environment creation, potentially introducing tampered dependencies into development and deployment pipelines.

How an attack unfolds

An attacker positions a malicious package matching the expected name and version on a configured index; when virtualenv creates an environment with --seeder pip --download, the tool skips its own verification and lets pip select the index candidate without digest checks.

How to fix it

Upgrade virtualenv to version 21.14.9 or later; ensure all Python environment creation workflows explicitly pin trusted indexes and enable digest verification where supported.

How to confirm the fix worked

Confirm virtualenv version is 21.14.9+; test environment creation commands with --seeder pip --download against a controlled index and verify digest checks occur in logs.

Typical attack path

  1. Configure a non-PyPI index or mirror with a matching package
  2. Invoke virtualenv with --seeder pip --download leaving default index settings active
  3. virtualenv calls get_pip_install_cmd which bypasses download_wheel and verify_wheel_digest
  4. pip selects the index candidate without SHA-256 validation against PyPI
  5. Malicious wheel is installed into the isolated environment

How to detect it

Review virtualenv and pip logs for environment creation commands that used --seeder pip --download without subsequent wheel digest verification entries; inspect installed package origins in created environments.

What your security team should do

  • Immediately upgrade all virtualenv installations to 21.14.9 or newer
  • Audit Python environment bootstrapping scripts for --seeder pip usage
  • Enforce explicit index configuration and disable reliance on default PyPI digest policy
  • Monitor package installation logs for unexpected index sources during virtualenv creation

The record

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities