CVE-2026-113717 is a vulnerability in virtualenv's pip seeder when used with the --seeder pip and --download options. In this scenario, virtualenv skips its wheel digest verification and allows pip to fetch wheels from an index without verifying their SHA-256 digest against PyPI metadata. This can lead to installation of modified or malicious pip wheels if an attacker controls the index configured in pip.conf. The issue affects virtualenv versions starting from 2.7.3. The vulnerability has a low CVSS score and no known exploits in the wild.