virtualenv: Downloaded wheel selection and caching precede verification

影響: pip:virtualenv < 21.14.9 → 21.14.9

Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verification failure does not remove the downloaded file from that cache. Anthropic's OSS Scanner reported this as ANT-2026-ST00DRO3 in virtualenv-20261015-005, received on 15 October 2026. Affected area Download selection and promotion into the reusable wheel cache. Attacker-controlled input A download must fail verification, or the archive selected from pip output m…

GitHub Advisory Databaseで読む

2026/10/24 07:25、GitHub Advisory Databaseが「virtualenv: Downloaded wheel selection and caching precede verification」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: Python。CVE: CVE-2026-113714。