CVE-2026-113714 pypa CVE debrief

Who should care

Defenders responsible for managing package dependencies and ensuring the security of their environments should be aware of this vulnerability. They should assess their exposure and take necessary actions to mitigate the risk.

Why it matters

The vulnerability in virtualenv allows for potential malicious package indexes to inject lines affecting the download and verification process of wheels. Defenders should prioritize upgrading to version 21.14.9 or later and review their package management processes.

• Verification of downloaded wheels may be bypassed
• Potential for malicious package indexes to inject lines affecting verification
• Need to upgrade to virtualenv version 21.14.9 or later
• Review of package management processes required

Technical summary

The vulnerability in virtualenv arises from the download and verification process of wheels. Wheel downloads are directly placed into a reusable wheelhouse, while verification targets are selected from pip's textual output. This discrepancy allows a malicious package index to inject lines through discarded links, potentially affecting the verification process. Defenders should prioritize upgrading to virtualenv version 21.14.9 or later to mitigate this vulnerability. They should also verify their current version and review their package management processes to ensure the security of their environments. The vulnerability was reported by Anthropic's OSS Scanner as ANT-2026-ST00DRO3 in virtualenv-20261015-005. The

Defensive priority

Defenders should prioritize upgrading to virtualenv version 21.14.9 or later to mitigate this vulnerability. They should also verify their current version and review their package management processes to ensure the security of their environments.

Recommended defensive actions

• Upgrade to virtualenv version 21.14.9 or later
• Verify current virtualenv version
• Review package management processes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was reported by Anthropic's OSS Scanner as ANT-2026-ST00DRO3 in virtualenv-20261015-005. The issue lies in the download selection and promotion into the reusable wheel cache. A package index can inject a line through a discarded link's description, affecting the verification process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.