Pypa Virtualenv vulnerabilities

CVE-2026-113714 [LOW] CWE-354 CVE-2026-113714: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_w virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading

CVE-2026-113715 [LOW] CWE-93 CVE-2026-113715: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject ke