Threats tagged 'bit-virtualenv-2026-113717'

A vulnerability in virtualenv prior to version 21.14.9 allows pip seeding with the --download option to bypass wheel digest verification when using the default PyPI index. This occurs because the verification path is skipped, potentially allowing selection of a wheel matching the package and version without verifying its SHA-256 digest against PyPI metadata. The issue does not affect TLS security or allow control over the index response. It is fixed in version 21.14.9.