CVE-2026-113714 virtualenv: Downloaded wheel selection and caching precede verification
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113714?
CVE-2026-113714 is a low-severity vulnerability in pypa virtualenv, published on 20 Oct 2026.
Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without verification. A separate rejected-cache-file variant requires control over downloaded data or archive selection but not the forged-line prerequisites. Explicit custom-index exceptions are outside the promised PyPI comparison, and the issue does not independently bypass TLS or establish control of default PyPI. This issue is fixed in version 21.14.9.
Weakness: CWE-354
Which versions are affected by CVE-2026-113714?
3 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | All versions | 21.14.9 |
virtualenv PyPI | All versions | 21.14.9 |
virtualenv PyPI | All versions | 21.14.9 |
How do I fix CVE-2026-113714?
Upgrade virtualenv to 21.14.9 or later.
Is CVE-2026-113714 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113714 exists.
Sources
Also known as BIT-virtualenv-2026-113714, DEBIAN-CVE-2026-113714, ECHO-ba42-b2d8-bef3, GHSA-494p-63j8-28p3, MINI-98qw-6qj6-47h8, UBUNTU-CVE-2026-113714.