A vulnerability in virtualenv's wheel download and caching mechanism allows a downloaded wheel to be cached before verification completes. This can lead to a modified or unverified wheel being reused later, potentially causing execution of tampered code. The issue arises because virtualenv selects the verification target from pip's textual output rather than the actual downloaded file, and verification failures do not remove the cached file. A fix is available in version 2.29.3.