CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

EUVD-2026-105303

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721 virtualenv: Generated files can follow existing destination links

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721

The virtualenv tool is vulnerable to a link-following issue prior to version 21.14.9 . The root cause lies in ViaTemplateActivator._generate() only removing existing output if Path.exists() is true, which allows a dangling symlink to persist and redirect generated activation content. Additionally...