CVE-2026-113717 is a vulnerability in virtualenv's pip seeder when used with the --download option. The issue arises because virtualenv skips wheel digest verification for wheels obtained via index lookup during pip seeding, allowing an attacker-controlled index to serve a modified pip wheel without detection. This can lead to installation of tampered pip packages in the created environment. The vulnerability requires both --seeder pip and --download options to be enabled and a non-default index configured. A fix is available in virtualenv version 6.1.1_4.