virtualenv: Downloaded wheel selection and caching precede verification
影響: pip:virtualenv < 21.14.9 → 21.14.9
Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verification failure does not remove the downloaded file from that cache. Anthropic's OSS Scanner reported this as ANT-2026-ST00DRO3 in virtualenv-20261015-005, received on 15 October 2026. Affected area Download selection and promotion into the reusable wheel cache. Attacker-controlled input A download must fail verification, or the archive selected from pip output m…
| CVE | CVE-2026-113714 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 07:25, GitHub Advisory Database에서 "virtualenv: Downloaded wheel selection and caching precede verification"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: Python. CVE: CVE-2026-113714.