CVE-2026-113714 is a vulnerability in virtualenv's wheel download and caching mechanism. The issue arises because downloaded wheel files are placed directly into a reusable cache before verification completes. Verification uses pip's textual output to select the file to check, which can be manipulated by a malicious package index. This can cause a modified wheel to be cached and reused despite failing verification, potentially leading to the use of tampered packages. The flaw does not bypass TLS or affect the default PyPI setup and was fixed in virtualenv version 2.5.1_1.