CVE-2026-113717: virtualenv: Pip seeding with download omits wheel digest verification
The pip seeder acquires bundled wheels with download=False and lets pip access the index when –download is selected. Index candidates on that path do not pass through virtualenv’s wheel digest verification.
Anthropic’s OSS Scanner reported this as ANT-2026-74ALJBUF in virtualenv-20261015-005, received on 15 October 2026.
References
- github.com/advisories/GHSA-cx28-75q4-x26q
- github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96
- github.com/pypa/virtualenv/pull/3430
- github.com/pypa/virtualenv/releases/tag/21.14.9
- github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q
- nvd.nist.gov/vuln/detail/CVE-2026-113717
Code Behaviors & Features
Detect and mitigate CVE-2026-113717 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →