CVE-2026-113717 is a vulnerability in virtualenv's pip seeder when used with the --download option. The issue arises because the pip seeder downloads bundled wheels with download=False, skipping virtualenv's wheel digest verification. This allows an attacker controlling a package index to serve a modified pip wheel that bypasses the SHA-256 digest check, potentially installing tampered code. The vulnerability requires both the --seeder pip and --download options to be enabled. A fix is available in virtualenv version 2026.10.1.