Python Environment Tool Vulnerability in Virtualenv Affects Downloads

CVE-2026-113717

What is CVE-2026-113717?

A vulnerability in virtualenv, a tool for creating isolated Python environments, allows certain configurations to bypass download and integrity checks for packages. Specifically, prior to version 21.14.9, the function PipInvoke.get_pip_install_cmd() mismanaged the seeder for pip and could select indexed candidates without verifying the PyPI SHA-256 metadata. This occurs when using a custom index while leaving index environment variables unset, thus allowing the default-index PyPI digest comparison to remain active. Although TLS remains unaffected, this flaw poses a risk of downloading potentially unverified packages.

References