A vulnerability in virtualenv versions >=4.62.0 <4.67.0 allows a downloaded wheel file to be cached and reused before its integrity verification completes. This occurs because virtualenv writes the downloaded wheel directly into the reusable wheel cache and then verifies the wheel by parsing pip's textual output rather than verifying the actual cached file. If verification fails, the corrupted or modified wheel remains in the cache and can be reused later, potentially leading to execution of tampered code. The issue was fixed in version 4.67.0.