A vulnerability in virtualenv's pip seeder with the --download option allows installation of pip wheels from an index without verifying the wheel's SHA-256 digest against PyPI metadata. This occurs because the pip seeder skips virtualenv's wheel digest verification when downloading wheels, potentially allowing a malicious index to serve a modified pip wheel that is installed without integrity checks. Both --seeder pip and --download options must be used to trigger this issue. The vulnerability affects virtualenv versions from 4.62.0 up to but not including 4.67.0 and has a low severity score.