Injection Vulnerability in Virtualenv Affects Python Package Management

CVE-2026-113714

What is CVE-2026-113714?

The vulnerability in Virtualenv allows a controlled package index to manipulate the package download process, leading to potential misrepresentation of package integrity. Prior to version 21.14.9, the download_wheel() function could mistakenly hash data from a misleading Saved line, allowing an attacker to cache an improperly validated archive. This vulnerability leverages knowledge of the genuine bundled wheel's absolute path and requires manipulation of a discarded link's attributes. It does not independently compromise TLS or the default PyPI access, but it highlights risks in package selection and verification processes.

References