virtualenv: Pip seeding with download omits wheel digest verification
影響: pip:virtualenv < 21.14.9 → 21.14.9
The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected. Index candidates on that path do not pass through virtualenv's wheel digest verification. Anthropic's OSS Scanner reported this as ANT-2026-74ALJBUF in virtualenv-20261015-005, received on 15 October 2026. Affected area Wheel selection by the pip seeder when downloads are enabled. Attacker-controlled input The pip seeder and download option must be selected. The finding concerns…
Read on GitHub Advisory Database
| CVE | CVE-2026-113717 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/24/2026, 01:50 PM |
| Data | Markdown JSON |
On 10/24/2026, 07:26 AM, GitHub Advisory Database published "virtualenv: Pip seeding with download omits wheel digest verification" (type: Advisory). Severity is "Low" (low). Related technologies: Python. CVE: CVE-2026-113717.