Threats tagged 'brew-hatch-cve-2026-102930'

A vulnerability in virtualenv versions >=1.2.0 <1.6.2 and >=1.9.3 <1.18.1_1 allows downloaded pip and setuptools wheels to be used without integrity verification. This flaw could enable an attacker who controls or intercepts the package source to substitute malicious wheels, which virtualenv would cache and use in new environments without warning. The issue is fixed in versions 1.6.2 and 1.18.1_1 by verifying the SHA256 checksum of downloaded wheels against PyPI's public JSON API, except when a custom index is configured.