| Name | CVE-2026-102930 |
| Description | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1149650 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| python-virtualenv (PTS) | bookworm | 20.17.1+ds-1 | vulnerable |
| trixie | 20.31.2+ds-1+deb13u1 | vulnerable | |
| forky, sid | 21.5.1+ds-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| python-virtualenv | source | (unstable) | (unfixed) | 1149650 |
[trixie] - python-virtualenv <no-dsa> (Minor issue)
[bookworm] - python-virtualenv <postponed> (Minor issue)
https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45
https://github.com/pypa/virtualenv/pull/3251
Fixed by: https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d (21.7.12)