{"id":"ghsa-ghsa-cx28-75q4-x26q","seq":661281,"kind":"advisory","title":"virtualenv: Pip seeding with download omits wheel digest verification","url":"https://github.com/advisories/GHSA-cx28-75q4-x26q","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cx28-75q4-x26q","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nThe pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected. Index candidates on that path do not pass through virtualenv's wheel digest verification. Anthropic's OSS Scanner reported this as ANT-2026-74ALJBUF in virtualenv-20261015-005, received on 15 October 2026. Affected area Wheel selection by the pip seeder when downloads are enabled. Attacker-controlled input The pip seeder and download option must be selected. The finding concerns…","severity":"low","techs":["python"],"cves":["CVE-2026-113717"],"tags":["GHSA-cx28-75q4-x26q","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:26:04.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}