Is CVE-2026-102930 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102930 being exploited in the wild.

How severe is CVE-2026-102930?

High severity, with a CVSS score of 4, published 29 September 2026.

Which products and versions are affected?

Pypa Virtualenv before 21.7.12; virtualenv (PyPI) <= 21.7.11, ECOSYSTEM:introduced=0,fixed=21.7.12.

Is there a fix for CVE-2026-102930?

Yes. virtualenv (PyPI): upgrade to 21.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102930 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102930?

Check whether you run Pypa Virtualenv or virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102930: virtualenv wheel digest verification bypass

Q: Is there a fix for CVE-2026-102930?

Yes. virtualenv (PyPI): upgrade to 21.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102930 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-102930?

Check whether you run Pypa Virtualenv or virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102930 · Severity: high · CVSS 4 · Published 2026-09-29

virtualenv is a Python tool that creates isolated environments with preconfigured package managers. Prior to version 21.7.12, the tool downloaded seed wheels (pip and setuptools) without verifying their authenticity against PyPI's checksums. A compromised package index, intercepted download, or stale mirror could deliver malicious wheels that virtualenv would cache and install into all subsequently created environments, effectively compromising the entire development or deployment pipeline.

Technologies: Pypa Virtualenv, virtualenv (PyPI). Vendors: Pypa, PyPI.

Quick answers

Is CVE-2026-102930 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102930 being exploited in the wild.
How severe is CVE-2026-102930?: High severity, with a CVSS score of 4, published 29 September 2026.
Which products and versions are affected?: Pypa Virtualenv before 21.7.12; virtualenv (PyPI) <= 21.7.11, ECOSYSTEM:introduced=0,fixed=21.7.12.
Is there a fix for CVE-2026-102930?: Yes. virtualenv (PyPI): upgrade to 21.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102930 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102930?: Check whether you run Pypa Virtualenv or virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

virtualenv (PyPI): upgrade to 21.7.12 or later
```
pip install "virtualenv>=21.7.12"
```

Technical details

The vulnerability exists in the download_wheel() function which accepts pip and setuptools seed wheels for periodic updates or via the --download option without validating their SHA256 hash against PyPI's authoritative BUNDLE_SHA256 records. An attacker controlling the index, intercepting TLS, or exploiting a stale mirror can substitute a different wheel under the same distribution name and version. The fix adds verify_wheel_digest() to check downloaded wheels against PyPI's public JSON record, with verification intentionally skipped for custom indexes configured via PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX.

Affected products

pypa virtualenv before 21.7.12

Identifiers

CVE-2026-102930
GHSA-94p9-xgh2-xp45
PYSEC-2026-4011

Timeline

2026-09-29: disclosed
2026-09-18: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.