A vulnerability in virtualenv's wheel download and caching mechanism allows a downloaded wheel to be cached before verification completes. An attacker-controlled package index can cause a mismatch between the downloaded file and the file verified by virtualenv, leading to reuse of unverified or tampered wheels from the cache. This issue affects virtualenv versions from 4.6.2_1 up to but not including 4.7.0_1 and was fixed in version 4.7.0_1.