CVE-2026-113714

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without verification. A separate rejected-cache-file variant requires control over downloaded data or archive selection but not the forged-line prerequisites. Explicit custom-index exceptions are outside the promised PyPI comparison, and the issue does not independently bypass TLS or establish control of default PyPI. This issue is fixed in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113714

EUVD

EUVD-2026-105260

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-354	The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

Executive Summary

This vulnerability in virtualenv (versions 21.14.8 and earlier) involves a flaw in how downloaded Python wheels are handled. Wheels are stored in a cache before verification, allowing attackers to manipulate the selection process. By forging a 'Saved' line via a manipulated attribute, an attacker can trick virtualenv into verifying the wrong file. Even if verification fails, the rejected file remains in the cache for potential reuse. The issue does not bypass TLS or affect default PyPI but requires control over downloaded data or archive selection.

Detection Guidance

Check the installed version of virtualenv using pip show virtualenv. If the version is 21.14.8 or earlier, the system is vulnerable. Review cache directories for unexpected wheel files or failed downloads that may indicate tampering.

Impact Analysis

An attacker could exploit this to install malicious or incorrect Python packages in your virtual environment. This could lead to compromised software, data breaches, or unexpected behavior in applications. The vulnerability allows unverified or tampered wheels to persist in the cache, potentially being reused in future environment creations without proper checks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it does not involve unauthorized data access or disclosure. However, it could indirectly impact compliance by introducing supply chain risks if malicious wheels are cached and reused, potentially leading to compromised environments. The fix improves integrity checks, which may help meet security requirements in standards like ISO 27001 or NIST guidelines.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later using pip install --upgrade virtualenv.
Clear the wheel cache by removing files in ~/.cache/virtualenv/wheel or the equivalent cache directory on your system.
Verify all installed wheels by recreating virtual environments and checking for errors during installation.

Hi! I’m here to help you understand CVE-2026-113714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...