A vulnerability in virtualenv's wheel download and caching mechanism allows a downloaded wheel to be cached before its integrity verification completes. An attacker controlling a package index can cause a mismatch between the downloaded file and the file verified by virtualenv, leading to reuse of unverified or tampered wheels from the cache. This issue affects virtualenv versions from 2026.8.0_1 up to but not including 2026.10.1 and was fixed in version 2026.10.1.