virtualenv: Pip seeding with download omits wheel digest verification

影響: pip:virtualenv < 21.14.9 → 21.14.9

The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected. Index candidates on that path do not pass through virtualenv's wheel digest verification. Anthropic's OSS Scanner reported this as ANT-2026-74ALJBUF in virtualenv-20261015-005, received on 15 October 2026. Affected area Wheel selection by the pip seeder when downloads are enabled. Attacker-controlled input The pip seeder and download option must be selected. The finding concerns…

GitHub Advisory Databaseで読む

2026/10/24 07:26、GitHub Advisory Databaseが「virtualenv: Pip seeding with download omits wheel digest verification」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: Python。CVE: CVE-2026-113717。