CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without verification. A separate rejected-cache-file variant requires control over downloaded data or archive selection but not the forged-line prerequisites. Explicit custom-index exceptions are outside the promised PyPI comparison, and the issue does not independently bypass TLS or establish control of default PyPI. This issue is fixed in version 21.14.9.

• CWE-354

• https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96
• https://github.com/pypa/virtualenv/pull/3430
• https://github.com/pypa/virtualenv/releases/tag/21.14.9
• https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113709Argo CD is a declarative, GitOps continuous delivery tool fo…9.9
• CVE-2026-11371The BetterDocs WordPress plugin before 4.5.5 does not sanit…6.1
• CVE-2026-113710ApostropheCMS is an open-source Node.js content management s…5.9
• CVE-2026-113711ApostropheCMS is an open-source Node.js content management s…7.5
• CVE-2026-113712Cachet is an open-source status page system. Versions 2.4.1 …4.8
• CVE-2026-113713virtualenv is a tool for creating isolated virtual python en…4.4
• CVE-2026-113715virtualenv is a tool for creating isolated virtual python en…2
• CVE-2026-113716virtualenv is a tool for creating isolated virtual python en…4.5
• CVE-2026-113717virtualenv is a tool for creating isolated virtual python en…2.3
• CVE-2026-113718virtualenv is a tool for creating isolated virtual python en…7.1
• CVE-2026-113719virtualenv is a tool for creating isolated virtual python en…4.5
• CVE-2026-11372IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vuln…5.4