CVE-2026-102930 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
Attackers can inject malicious code into virtual environments by substituting seed wheels when custom indexes are configured, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-102930?
CVE-2026-102930 is a high-severity vulnerability in pypa virtualenv, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12.
Weakness: CWE-494
Which versions are affected by CVE-2026-102930?
4 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | All versions | 21.7.12 |
virtualenv PyPI | All versions | 21.7.12 |
virtualenv PyPI | All versions | 21.7.12 |
virtualenv PyPI | All versions | 21.7.12 |
How do I fix CVE-2026-102930?
Upgrade virtualenv to 21.7.12 or later.
Is CVE-2026-102930 being exploited?
There is no known exploitation of CVE-2026-102930 in the wild and no public exploit code.
Sources
Also known as AZL-105669, BIT-virtualenv-2026-102930, DEBIAN-CVE-2026-102930, ECHO-2248-faed-ae67, GHSA-94p9-xgh2-xp45, MINI-cpmh-xwwj-c7xf and 4 more.