virtualenv EUVD-2026-105260

Exploitation requires an attacker-controlled package index and affects only virtualenv 21.14.8 during its wheel-download/seeding path. The forged-line variant additionally requires default-index digest comparison to be enabled, the ability to inject a misleading pip 'Saved' line through a discarded link's data-requires-python attribute, AND knowledge of the absolute filesystem path to the genuine bundled wheel. The separate rejected-cache-file variant instead requires control over the downloaded data or archive selection but not the forged-line prerequisites. Significant limiting factors: the issue explicitly does not bypass TLS and does not grant control of default PyPI (so the attacker must already be positioned to serve a malicious index), explicit custom-index exceptions are outside the promised PyPI comparison, and successful attack depends on the victim running the vulnerable virtualenv seeding (UI:P) with high overall complexity (AC:H/AT:P).

This is a genuinely low-priority issue whose signals are consistent rather than conflicting. The vendor CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P, impacts VC:L/VI:L/VA:L) reflects a hard-to-reach integrity-check weakness (CWE-354) rather than a readily exploitable flaw. There is no CISA KEV listing and no public exploit identified at time of analysis - only the upstream fix commit and GHSA advisory are available. EPSS was not supplied in the input. No SSVC decision record was provided. The high attack complexity (AC:H), the presence of a specific attack requirement (AT:P), and the dependency on passive user interaction (UI:P) all point to a narrow, precondition-heavy attack, not an automatable or widespread one. Crucially, the description itself states the issue 'does not independently bypass TLS or establish control of default PyPI,' so an attacker must already be positioned to control a package index - a substantial prerequisite that is not captured in a single raw metric. Net: real but marginal risk, appropriately rated low; not a patch-tonight item absent a threat model involving untrusted or compromised indexes.

An attacker who already controls a package index that a developer's virtualenv seeding talks to serves a crafted index response: for the forged-line variant they inject a misleading pip 'Saved' line via a discarded link's data-requires-python attribute (also needing the absolute path to the genuine bundled wheel), or for the simpler variant they manipulate the downloaded data/archive selection. Because download_wheel() writes downloads into the reusable wheel cache before verifying, a digest-mismatched archive is left in the cache and can later be selected and installed without verification. No public exploit code is known, and the chain requires high complexity plus the victim running an affected virtualenv (21.14.8).