A vulnerability in virtualenv versions from 2026.8.17_1 up to but not including 2026.10.20 allows a downloaded wheel file to be cached before its integrity verification is completed. This can lead to a scenario where a modified or unverified wheel remains in the reusable wheel cache, potentially causing the use of tampered packages in later environments. The issue arises because virtualenv selects the verification target based on pip's textual output rather than the actual downloaded file, and verification failures do not remove the cached file. A fix was released in version 2026.10.20.