Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

virtualenv may install malicious packages when downloading updates

CVE-2026-102930 · published 15 days ago
Summary

Older versions of virtualenv download the base pip and setuptools files without verifying their digital signatures. If an attacker can alter the download source, they could insert harmful code that would be copied into every new environment you create. Upgrade virtualenv to version 21.7.12 or later to ensure these files are checked before use.

What to do
  • Update bernat gabor virtualenv to version 21.7.12.
  • Update virtualenv to version 21.7.12.
  • Update virtualenv to version 21.4.2+aikido.1.
  • Update virtualenv to version 20.35.4+aikido.4.
  • Update virtualenv to version 20.36.1+aikido.5.
  • Update virtualenv to version 21.5.1+aikido.2.
  • Update virtualenv to version 21.7.8+aikido.2.
  • Update virtualenv to version 21.7.1+aikido.2.
  • Update virtualenv to version 21.7.9+aikido.2.
  • Update virtualenv to version 21.2.4+aikido.2.
  • Update virtualenv to version 21.7.5+aikido.3.
  • Update virtualenv to version 21.7.4+aikido.2.
  • Update virtualenv to version 21.7.4+aikido.3.
  • Update virtualenv to version 21.7.4+aikido.4.
Affected software
Ecosystem VendorProductAffected versions
– pypa virtualenv < 21.7.12
PyPI bernat gabor virtualenv < 21.7.12
Fix: upgrade to 21.7.12
pip bernat gabor virtualenv <= 21.7.11
Fix: upgrade to 21.7.12
Ubuntu:14.04:LTS canonical python-virtualenv All versions
Debian:12 debian python-virtualenv All versions
Bitnami – virtualenv < 21.7.12
Fix: upgrade to 21.7.12
Root:PyPI – virtualenv < 21.4.2+aikido.1
< 20.35.4+aikido.4
< 20.36.1+aikido.5
< 21.5.1+aikido.2
< 21.7.8+aikido.2
< 21.7.1+aikido.2
< 21.7.9+aikido.2
< 21.2.4+aikido.2
< 21.7.5+aikido.3
< 21.7.4+aikido.2
< 21.7.4+aikido.3
< 21.7.4+aikido.4
Fix: upgrade to 21.4.2+aikido.1
pip – virtualenv <= 21.7.11
Fix: upgrade to 21.7.12
Original advisory text
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-494Download of Code Without Integrity Check
Timeline
Published29 Sep 2026
Updated14 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-102930 · NVD
CVE-2026-102930 · MITRE
PYSEC-2026-4011 · OSV
GHSA-94p9-xgh2-xp45 · GHSA
UBUNTU-CVE-2026-102930 · OSV
GHSA-94p9-xgh2-xp45 · OSV
CVE-2026-102930 · OSV
DEBIAN-CVE-2026-102930 · OSV
BIT-virtualenv-2026-102930 · OSV
ROOT-APP-PYPI-CVE-2026-102930 · OSV
Track software like this
Free during beta