CVE-2026-113714: virtualenv: Downloaded wheel selection and caching precede verification
Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip’s textual output. A verification failure does not remove the downloaded file from that cache.
Anthropic’s OSS Scanner reported this as ANT-2026-ST00DRO3 in virtualenv-20261015-005, received on 15 October 2026.
References
- github.com/advisories/GHSA-494p-63j8-28p3
- github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96
- github.com/pypa/virtualenv/pull/3430
- github.com/pypa/virtualenv/releases/tag/21.14.9
- github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3
- nvd.nist.gov/vuln/detail/CVE-2026-113714
Code Behaviors & Features
Detect and mitigate CVE-2026-113714 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →