virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9,
    PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and
    then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and
    verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an
    index candidate matching the bundled package and version can therefore be selected without comparison to
    PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain
    outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving
    the index environment variables unset so the comparison policy remained active. This condition does not
    independently defeat TLS or establish control of the index response. This issue is fixed in version
    21.14.9. (CVE-2026-113717)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9,     PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and     then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and     verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an     index candidate matching the bundled package and version can therefore be selected without comparison to     PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain     outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving     the index environment variables unset so the comparison policy remained active. This condition does not     independently defeat TLS or establish control of the index response. This issue is fixed in version     21.14.9. (CVE-2026-113717)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477207	SCA: security update for virtualenv (GHSA-cx28-75q4-x26q)	Tenable Cloud Security	SCA Checks	Local	low
477207	SCA: security update for virtualenv (GHSA-cx28-75q4-x26q)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
371045	Linux Distros Unpatched Vulnerability : CVE-2026-113717	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-113717

low

Tenable Plugins

low

low

low