CVE-2026-113714 is a vulnerability in virtualenv's wheel download and caching mechanism where downloaded wheel files are placed directly into the reusable wheel cache before verification. The verification process selects the file to check based on pip's textual output rather than the actual downloaded file, allowing an attacker-controlled package index to inject forged output lines. This can cause a modified wheel to be cached and reused despite failing verification, potentially leading to the use of tampered packages in new environments. The issue does not bypass TLS or affect the default PyPI setup and requires a custom index with digest verification enabled. A fix was released in virtualenv version 1.18.1_2 that downloads wheels to a temporary location and only promotes them to the cache after successful verification.