Threats tagged 'brew-poetry-cve-2026-102930'

Virtualenv versions prior to 1.2.2_1 and 2.5.0 do not verify the integrity of downloaded pip and setuptools wheels before use. This allows a compromised index, stale mirror, or man-in-the-middle attacker to substitute malicious wheels that virtualenv would cache and use without warning. The issue is fixed by verifying the downloaded wheel's SHA256 hash against PyPI's public JSON API, except when a custom index is configured.