CVE-2026-113720

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

CVE-2026-113720 virtualenv: Seeded files retain permissions from an older cache

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

CVE-2026-113720

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

CVE-2026-113719 virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113719

The virtualenv tool is vulnerable to a path traversal issue prior to version 21.14.9 . The PipInstall._uninstall_previous_version() function accepts existing seed-package metadata, and _uninstall_dist() joins entries from top_level.txt and RECORD without verifying directory containment. If a reus...

CVE-2026-113719 virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

AZL-110103 CVE-2026-113713 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

DEBIAN-CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

The virtualenv tool, used for creating isolated Python environments, is vulnerable in versions 21.14.8 through 21.14.10 . The app-data seeder can leave an environment linked to temporary package files that are deleted upon completion of the creation process. This occurs because the environment-va...

CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

PT-2026-118626

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The app-data copy seeder uses the shutil.copy function to copy cached package files into new environments. This process causes cached source modes to override the current run's umask a user...

PT-2026-118625

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description An issue exists where PipInstall. uninstall previous version accepts existing seed-package metadata and uninstall dist joins entries from top level.txt and RECORD to site-packages without...

PT-2026-118614

Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.8 through 21.14.9 Description The app-data seeder may leave an environment linked to temporary package files that are deleted upon completion of the creation process. This state can be triggered via environment-variab...

Python Packaging Authority virtualenv resource management error vulnerability

The Python Packaging Authority’s virtualenv version 21.14.8 to 21.14.10 has a resource management vulnerability. This vulnerability arises from the app-data seeder, which may cause the environment to link to temporary package files that are deleted after creation. This state can be enabled throug...