Improper validation of integrity check value in py3-virtualenv - CVE-2026-113714
Published: November 9, 2026
Vulnerability identifier: #VU163148
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-113714
CWE-ID: CWE-354
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a malicious package-index operator to execute code as a victim who later runs pip in a newly created environment.
The vulnerability exists due to virtualenv caching downloaded wheels before verification and selecting the verification target from index-influenced pip output. A malicious package-index operator can supply a modified wheel and forge output naming a known genuine local wheel when the victim updates seed wheels using that configured index with PyPI digest comparison enabled, causing the modified wheel to be accepted and reused.
Affected software
py3-virtualenv
How to mitigate CVE-2026-113714
Install security update from vendor's website.
py3-virtualenv - update to 21.14.9