CVE-2026-113717: Package Digest Verification Bypass in virtualenv Pip Seeder

Vulnerability ID: CVE-2026-113717
CVSS Score: 2.3
Published: 2026-10-23

A verification bypass vulnerability in virtualenv allows unverified Python wheel installation when using pip seeding with the download flag. Affected versions fail to perform SHA-256 digest validation against PyPI metadata before invoking pip.

TL;DR

virtualenv prior to 21.14.9 fails to enforce internal SHA-256 digest verification when seeding environments with '--seeder pip --download', allowing pip to fetch and install wheels without PyPI hash validation.

Technical Details

• Vulnerability ID: CVE-2026-113717 / GHSA-cx28-75q4-x26q
• CWE ID: CWE-494 (Download of Code Without Integrity Check)
• CVSS Score: 2.3 (CVSS v4.0 Low)
• EPSS Score: 0.00297 (21.21st percentile)
• Attack Vector: Network (Requires specific CLI flags and index configuration)
• Exploit Status: No public weaponized exploit
• Patched Version: virtualenv 21.14.9

Affected Systems

• virtualenv
• virtualenv: < 21.14.9 (Fixed in: 21.14.9)

Code Analysis

Commit: 7babec6

Fix pip invoke download wheel verification and staging path

Mitigation Strategies

• Upgrade virtualenv to version 21.14.9 or later
• Avoid combining '--seeder pip' with '--download' on unpatched virtualenv versions
• Enforce explicit index configurations via PIP_INDEX_URL and PIP_EXTRA_INDEX_URL environment variables

Remediation Steps:

1. Upgrade virtualenv across development and CI systems: pip install --upgrade virtualenv>=21.14.9
2. Audit build scripts and automation pipelines for usage of 'virtualenv --seeder pip --download'
3. Confirm installed virtualenv version via virtualenv --version

References

• GitHub Security Advisory GHSA-cx28-75q4-x26q
• virtualenv Pull Request #3430 Fix
• virtualenv Patch Commit 7babec66e043e1cc8bc66869a063653898719d96
• virtualenv Release 21.14.9 Tag
• NVD CVE-2026-113717 Detail
• CVE.org CVE-2026-113717 Record

Read the full report for CVE-2026-113717 on our website for more details including interactive diagrams and full exploit analysis.