CVE-2026-113714 is a low-severity vulnerability in virtualenv's wheel download and caching mechanism. The issue arises because downloaded wheel files are placed directly into a reusable cache before verification, and verification is based on pip's textual output rather than the actual downloaded file. This can allow a malicious package index to trick virtualenv into using a modified wheel by forging pip output lines, causing a mismatch between the cached file and the verified file. The vulnerability does not bypass TLS or affect the default PyPI setup and was fixed in virtualenv version 6.1.1_4.