BIT-VIRTUALENV-2026-113721 virtualenv: Generated files can follow existing destination links

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

PT-2026-132497

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator. generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cf...

Amazon Linux 2023 : python3.13-virtualenv (ALAS2023-2026-3296)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3296 advisory. virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download...

Amazon Linux 2023 : python3-virtualenv (ALAS2023-2026-3295)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3295 advisory. virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download...

Important: python-virtualenv

Issue Overview: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the...

Important: python3.13-virtualenv

Issue Overview: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the...

SUSE CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

Linux Distros Unpatched Vulnerability : CVE-2026-113721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when...

EUVD-2026-105303

virtualenv: Generated files can follow existing destination links...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via ViaTemplateActivator.generate and PyEnvCfg.write, which write generated activation scripts and pyvenv.cfg without first atomically replacing any existing symbolic or hard link at the destination path...

DEBIAN-CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

AZL-110124 CVE-2026-113721 affecting package python-virtualenv for versions less than 20.36.1-10

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721 virtualenv: Generated files can follow existing destination links

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721

The virtualenv tool is vulnerable to a link-following issue prior to version 21.14.9 . The root cause lies in ViaTemplateActivator._generate() only removing existing output if Path.exists() is true, which allows a dangling symlink to persist and redirect generated activation content. Additionally...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721 virtualenv: Generated files can follow existing destination links

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721 virtualenv: Generated files can follow existing destination links

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

PT-2026-118627

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description A flaw exists where ViaTemplateActivator. generate only removes existing output if Path.exists is true, which allows a dangling symlink to persist and redirect activation content. Additionally,...