{"id":"ghsa-ghsa-494p-63j8-28p3","seq":661282,"kind":"advisory","title":"virtualenv: Downloaded wheel selection and caching precede verification","url":"https://github.com/advisories/GHSA-494p-63j8-28p3","permalink":"https://vulnpulse.app/items/ghsa-ghsa-494p-63j8-28p3","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verification failure does not remove the downloaded file from that cache. Anthropic's OSS Scanner reported this as ANT-2026-ST00DRO3 in virtualenv-20261015-005, received on 15 October 2026. Affected area Download selection and promotion into the reusable wheel cache. Attacker-controlled input A download must fail verification, or the archive selected from pip output m…","severity":"low","techs":["python"],"cves":["CVE-2026-113714"],"tags":["GHSA-494p-63j8-28p3","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:25:22.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}