CVE-2026-1137172.3LowCWE-494

CVE-2026-113717: virtualenv: Pip seeding with download omits wheel digest verification

pypa · virtualenv

Affected: pypa virtualenv · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.3%probability of exploitation in the next 30 days

22nd percentile

050100

Higher than 22% of scored CVEs

2.3LowCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

pypa · virtualenv< 21.14.9

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Download of Code Without Integrity Check · Supply Chain and Malicious Code
Vendor: pypa
Published: October 2026
Band: Unlikely (under 1%), October 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-113717 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.