CVE-2026-102930

A flaw was found in virtualenv. When fetching seed packages such as pip or setuptools during environment creation or updates, virtualenv does not verify the integrity of downloaded files against authoritative cryptographic checksums. A network attacker or compromised mirror could substitute malicious packages under expected filenames. If virtualenv caches and installs these tampered packages into subsequent environments, an attacker can achieve arbitrary code execution.

An Important severity flaw was found in virtualenv, a tool for creating isolated Python virtual environments that is shipped in Red Hat products and offerings including Red Hat Enterprise Linux, Red Hat Ansible Automation Platform, Red Hat AI offerings, and other Red Hat cloud services. When virtualenv fetches pip or setuptools seed wheels over the network, through its periodic-update mechanism or the --download option, it does not verify the downloaded files against an authoritative cryptographic checksum. A network attacker able to intercept TLS traffic, or a compromised or stale package index or mirror, could substitute a malicious wheel under the expected distribution, version, and filename. virtualenv would then cache the tampered wheel and seed it into subsequently created virtual environments, which can result in arbitrary code execution. Red Hat products that bundle virtualenv are affected where this download path can be exercised, and fixes are being pursued through the respective product release streams; a small number of bundled components were assessed as not affected because the vulnerable component is not present in them. While the upstream project's security advisory rates this issue as low severity, Red Hat rates it as Important based on the potential for arbitrary code execution in environments created from tampered seed packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.