Threats tagged 'brew-virtualenvwrapper-cve-2026-102930'

Virtualenv versions prior to 4.8.4_2 and 6.1.1_3 do not verify the integrity of downloaded pip and setuptools wheels before use. This allows an attacker who can intercept or compromise the download source to substitute malicious wheels without detection. The issue is fixed by verifying the downloaded wheel's SHA256 hash against the official PyPI JSON API digest, except when using custom package indexes.