virtualenv’s Custom-Index Exception
PyPA’s 18 September 2026 advisory rates CVE-2026-102930 Low. It affects virtualenv through 21.7.11; the 21.7.12 release, published the same day, fixes it. Periodic updates and --download fetched pip/setuptools seed wheels without the integrity comparison already applied to bundled copies. An index breach, an outdated mirror or TLS interception could substitute bytes that would be cached and used in later environments. The advisory names no victim.
The fix compares the file’s SHA256 with the exact release’s digest from public PyPI’s JSON API. That comparison is skipped for custom indexes configured via PIP_INDEX, PIP_EXTRA_INDEX_URL or PIP_INDEX_URL, because private builds may intentionally differ.
Decide which build path you own
BlackTree analysis: Ask build owners where seed wheels come from and which setting chooses that source. Record the version, wheel hash and approving owner for a representative build. A successful environment creation does not establish provenance.
Use 21.7.12 or a newer upstream build. For distribution packages, follow the distributor’s update route. If an index was demonstrably compromised, compare build records with trusted artefacts before deciding on rebuilds. Without evidence, do not label every older environment infected. Record the checked path in the patch ticket.
