CVE-2026-113717 is a vulnerability in virtualenv's pip seeder when used with the --download option. The issue arises because the pip seeder downloads wheels without performing virtualenv's wheel digest verification, allowing an attacker-controlled index to serve a modified pip wheel that bypasses integrity checks. This can lead to installation of tampered pip code in the created environment. The vulnerability affects virtualenv versions from 2026.8.17_1 up to but not including 2026.10.20. A fix is available in version 2026.10.20.