CVE-2026-102930: Virtualenv Integrity Check Bypass in Downloaded Seed Wheels
Summary
CVE-2026-102930: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use. Affects virtualenv versions < 21.7.12. Fixed in 21.7.12. How to fix ↓
Also tracked for
- virtualenv · Bitnami
The same CVE-2026-102930 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Virtualenv is a tool that creates isolated Python environments, allowing developers to manage dependencies for different projects without conflicts. It simplifies the process of managing package versions and dependencies, making it easier to maintain projects. However, a recent vulnerability has been identified that affects the integrity of downloaded seed wheels, potentially exposing users to risks from compromised packages.
Vulnerability Detail
The vulnerability arises from the download_wheel() function, which executes pip download and directly passes the result to the seeder without verifying the integrity of the downloaded bytes. This lack of verification means that if a user downloads a wheel from a compromised index, a stale mirror, or if the download is intercepted (e.g., through a man-in-the-middle attack), a malicious wheel could be cached and used in future environments without any warning. The issue was addressed in version 21.7.12, where the downloaded wheel's SHA256 checksum is now compared against the digest reported by PyPI's public JSON API for that specific release.
How To Fix
Latest published version: 21.14.12 as of 22 Oct 2026
pip install --upgrade "virtualenv==21.14.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.7.12
This is the first release that contains the fix.
pip install --upgrade "virtualenv==21.7.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are using a custom index (via PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX), be aware that the integrity check will be skipped. Ensure that your custom index is trustworthy to mitigate risks.
Conclusion
The CVE-2026-102930 vulnerability in virtualenv poses significant risks by allowing unverified downloaded seed wheels to be used. It is crucial for users to update to version 21.7.12 or later to ensure the integrity of their packages. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for virtualenv →
FAQ
CVE-2026-102930 is a vulnerability in the virtualenv package that allows downloaded seed wheels to be used without integrity checks, potentially leading to the use of compromised packages.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is that a malicious actor could substitute a compromised wheel for a legitimate one, leading to potential security breaches in applications that rely on virtualenv.
In version 21.7.12 and later, the downloaded wheel's SHA256 checksum is computed and compared against the digest provided by PyPI's public JSON API, ensuring that the file has not been tampered with.
If you cannot update, ensure that you are using trusted sources for your wheels and consider using a private index that you control to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for virtualenv.
