CVE-2026-113717 is a vulnerability in virtualenv's pip seeder when used with the --download option. The issue arises because virtualenv skips wheel digest verification for wheels downloaded via pip's index lookup, allowing an attacker-controlled index to serve a modified pip wheel without detection. Both --seeder pip and --download options must be enabled for exploitation. The vulnerability was reported by Anthropic's OSS Scanner and fixed in virtualenv version 2.29.3.