CVE-2026-113714: Cache Poisoning and Unvalidated Wheel Download in virtualenv

Vulnerability ID: CVE-2026-113714
CVSS Score: 2.3
Published: 2026-10-23

Prior to version 21.14.9, virtualenv downloads wheel files directly into its reusable persistent cache directory prior to verifying PyPI digests or compatibility. Combined with unsanitized stdout parsing from pip, a controlled package index can cause virtualenv to calculate digests against pre-existing local files while leaving unverified archives in the shared persistent cache.

TL;DR

virtualenv versions prior to 21.14.9 suffer from cache poisoning due to unvalidated wheel writes into shared storage and stdout parsing vulnerabilities during package downloads.

Technical Details

• Vulnerability ID: CVE-2026-113714 / GHSA-494p-63j8-28p3
• CWE ID: CWE-354 (Improper Validation of Integrity Check Value)
• CVSS v4.0 Score: 2.3 (Low)
• Attack Vector: Network (AV:N/AC:H/AT:P/PR:N/UI:P)
• EPSS Score: 0.00212 (10.91th percentile)
• Exploit Status: Unproven / None
• CISA KEV Status: Not Listed
• Patched Version: virtualenv 21.14.9

Affected Systems

• virtualenv packages prior to version 21.14.9
• Python build environments seeding wheels from custom package indices
• virtualenv: < 21.14.9 (Fixed in: 21.14.9)

Code Analysis

Commit: 7babec6

Isolate wheel downloads into temporary staging directory and remove stdout parsing

Mitigation Strategies

• Upgrade virtualenv to version 21.14.9 or higher.
• Purge local virtualenv wheelhouse cache if connecting to custom or untrusted package indices.

Remediation Steps:

1. Run pip install --upgrade virtualenv>=21.14.9 to install the patched version.
2. Clear application cache data using virtualenv --clear-app-data or removing ~/.cache/virtualenv/wheel/house.
3. Ensure package index endpoints used during environment seeding enforce proper integrity controls.

References

• GitHub Security Advisory GHSA-494p-63j8-28p3
• virtualenv PR #3430
• virtualenv Commit 7babec66e043e1cc8bc66869a063653898719d96
• virtualenv 21.14.9 Release Tag
• NVD Vulnerability Detail - CVE-2026-113714
• CVE Record on CVE.org

Read the full report for CVE-2026-113714 on our website for more details including interactive diagrams and full exploit analysis.