CVE-2026-113714: Cache Poisoning and Unvalidated Wheel Download in virtualenv

The virtualenv package is a Python utility maintained by the Python Packaging Authority (PyPA) for generating isolated Python execution environments. During environment creation, virtualenv retrieves support dependencies such as pip, setuptools, and wheel. Downloaded binaries are cached in a shared, persistent local directory at wheel/house to accelerate subsequent environment creations.

In releases prior to version 21.14.9, virtualenv writes package downloads directly into this shared persistent cache before performing cryptographic digest validation or environment compatibility checks. Furthermore, virtualenv determines which file was downloaded by parsing text returned on standard output by pip during execution.

This architectural sequence creates a vulnerability to local cache poisoning when virtualenv interacts with a controlled or compromised package index. An attacker can manipulate output lines to bypass hash checks and commit unverified package archives into persistent storage.

The core flaw exists in virtualenv/seed/wheels/acquire.py inside the download_wheel() function. When fetching seed packages, virtualenv executes pip download passing the permanent wheel/house folder directly via the -d argument. Network responses are written straight into persistent storage before any cryptographic verification occurs.

To identify the target file for hash verification, _find_downloaded_wheel() parses pip stdout line by line, searching for prefixes such as Saved or File was already downloaded . When rendering log output for HTML index pages, pip echoes certain HTML tag attributes, including data-requires-python. A custom or malicious package index serving HTML responses can embed arbitrary text within these attributes.

When pip download processes an HTML link containing an attribute formatted like data-requires-python="Saved /path/to/genuine/wheel.whl", pip writes that text to standard output. virtualenv parses this line and targets the local, genuine file for SHA-256 digest validation. Consequently, verification succeeds against the local file while the unverified archive downloaded from the package index remains stored in wheel/house. In addition, when digest verification fails normally, virtualenv raises an exception but leaves the unverified binary on disk.

In vulnerable versions prior to 21.14.9, download_wheel() invokes pip download with direct destination output pointing to the permanent cache:

# Vulnerable implementation in acquire.py:
cmd = [
    sys.executable, "-c", PIP_RUN, "download",
    "--progress-bar", "off",
    "--only-binary=:all:",
    "--no-deps",
    "--python-version", for_py_version,
    "-d", str(to_folder), # Direct write into permanent cache
    to_download,
]

The fix introduced in Pull Request #3430 and commit 7babec66e043e1cc8bc66869a063653898719d96 refactors the workflow to download packages into an isolated temporary directory created with tempfile.TemporaryDirectory(dir=to_folder, prefix="download-"). The stdout parsing logic was replaced with direct filesystem inspection using folder.iterdir(), enforcing strict file count and specifier rules.

The patched implementation performs verification while the binary resides in staging:

# Fixed implementation in virtualenv 21.14.9:
with TemporaryDirectory(dir=to_folder, prefix="download-") as staging:
    cmd: Final = [
        sys.executable, "-c", PIP_RUN, "download",
        "--progress-bar", "off", "--disable-pip-version-check",
        "--only-binary=:all:", "--no-deps",
        "--python-version", for_py_version,
        "-d", staging, # Isolated temporary staging directory
        to_download,
    ]
    process: Final = Popen(cmd, env=env, stdout=PIPE, stderr=PIPE, universal_newlines=True, encoding="utf-8")
    out, err = process.communicate()
    if process.returncode != 0:
        raise CalledProcessError(process.returncode, cmd, output=out, stderr=err)
    
    # Inspect downloaded file directly from directory
    result: Final = _downloaded_wheel(Path(staging), distribution, version_spec)
    
    # Verify digest and Python compatibility in isolation
    if verify_against_pypi:
        verify_wheel_digest(result)
    if not result.support_py(for_py_version):
        raise RuntimeError(f"downloaded wheel {result.name} does not support Python {for_py_version}")
        
    # Atomically promote verified archive to persistent destination
    destination: Final = to_folder / result.name
    result.path.replace(destination)
    return Wheel(destination)

Additionally, get_pip_install_cmd in virtualenv/seed/embed/pip_invoke.py was updated to supply --find-links pointing to a private temporary directory populated strictly with selected wheels while passing --no-index to block arbitrary index lookups during environment seeding.

Exploiting CVE-2026-113714 requires that a user run virtualenv while configured to query an attacker-controlled or compromised package index. This scenario occurs in enterprise networks using custom package mirrors, internal index servers, or modified PIP_INDEX_URL settings.

In the forged output vector, the malicious index returns HTML containing anchor attributes designed to inject stdout strings, such as data-requires-python="Saved /absolute/path/to/trusted.whl". When pip prints the attribute text to stdout, virtualenv parses the line and calculates the cryptographic digest of the existing trusted file on disk.

Meanwhile, pip download writes the malicious package binary into wheel/house. Because digest verification succeeded against the trusted path, no exception is triggered during download processing. On subsequent executions of virtualenv, the local discovery routine find_compatible_in_house() retrieves the unverified malicious wheel from wheel/house and installs it without re-initiating PyPI digest verification.

The operational impact of this vulnerability is local cache poisoning, tracked under CWE-354 (Improper Validation of Integrity Check Value). Successful exploitation allows an attacker to inject unverified Python binaries into the local virtualenv cache shared across environments on the host.

CVSS v4.0 scores this issue at 2.3 (Low) with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. Attack complexity is rated High because it requires controlling index HTTP responses and obtaining knowledge of valid target filesystem paths. User interaction is required to initiate virtualenv execution against the custom index.

Despite the Low base CVSS score, the issue presents heightened risk in shared build infrastructure, multi-tenant CI/CD runners, and developer environments utilizing internal package mirrors. A poisoned persistent cache directory affects subsequent build jobs on the same machine, leading to arbitrary code execution inside created virtual environments.

To resolve CVE-2026-113714, upgrade virtualenv to version 21.14.9 or higher. The update replaces standard output parsing with directory inspection and isolates unverified downloads in temporary staging folders prior to atomic promotion.

Organizations running vulnerable versions of virtualenv that interact with custom package indices should clear local cache directories to eliminate unverified artifacts. Executing virtualenv --clear-app-data or deleting ~/.cache/virtualenv/wheel/house removes stored binaries.

For distribution maintainers unable to update to 21.14.9 immediately, backporting commit 7babec66e043e1cc8bc66869a063653898719d96 from PR #3430 mitigates the flaw by enforcing temporary directory staging and atomic replacement.