CVE-2026-102930
published 2026-09-29CVE-2026-102930: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for…
PriorityP341high7.7CVSS 4.0
AVNACHATPPRNUIPVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.16%
4.7th percentile
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | ansible-dev-tools-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-devspaces-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-tech-preview | ansible-devspaces-rhel9 | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| debian | python-virtualenv | — | — |
| devspaces | udi-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| pypa | virtualenv | < 21.7.12 | 21.7.12 |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhel8 | python-36 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-kserve-agent-rhel9 | — | — |
| rhoai | odh-kserve-controller-rhel9 | — | — |
| rhoai | odh-kserve-router-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
ghsa·2026-09-30
CVE-2026-102930 [HIGH] CWE-494 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
`download_wheel()` runs `pip download` and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a `BUNDLE_SHA256` that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or the `--download` flag had no equivalent verification.
A compromised index, a stale mirror, or a MITM'd download (when TLS is intercepted, e.g. via a misconfigured or malicious CA) could substitute a different wheel under the same distribution/version/filename, and virtualenv would cache and seed it into every environment created afterward with no warning.
Fixed by computing the downloaded wheel's sha25
VulDB
pypa virtualenv up to 21.7.11 Wheel Download download_wheel authorization
vuldb·2026-09-29·CVSS 7.7
CVE-2026-102930 [HIGH] pypa virtualenv up to 21.7.11 Wheel Download download_wheel authorization
A vulnerability identified as problematic has been detected in pypa virtualenv up to 21.7.11. The affected element is the function download_wheel of the component Wheel Download. The manipulation leads to missing authorization.
This vulnerability is documented as CVE-2026-102930. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
Red Hat
virtualenv: virtualenv: Arbitrary code execution via unverified downloaded seed wheels
vendor_redhat·2026-09-29·CVSS 7.7
CVE-2026-102930 [HIGH] CWE-494 virtualenv: virtualenv: Arbitrary code execution via unverified downloaded seed wheels
virtualenv: virtualenv: Arbitrary code execution via unverified downloaded seed wheels
A flaw was found in virtualenv. When fetching seed packages such as pip or setuptools during environment creation or updates, virtualenv does not verify the integrity of downloaded files against authoritative cryptographic checksums. A network attacker or compromised mirror could substitute malicious packages under expected filenames. If virtualenv caches and installs these tampered packages into subsequent environments, an attacker can achieve arbitrary code execution.
Package: openshift-lightspeed/lightspeed-service-api-rhel9 (OpenShift Lightspeed) - Affected
Package: ansible-automation-platform-25/ansible-dev-tools-rhel8 (Red Hat Ansible Automation Platform 2) - Affected
Package: ansible-automatio
No detection rules found.
No public exploits indexed.
2026-09-29
Published