Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the FromAppData seed mechanism in src/virtualenv/seed/embed/viaappdata/viaappdata.py, when symlinkappdata is enabled against a transient temporary app-data store. In this configuration, virtualenv creates symlinks fro...

CVE-2026-113713

The virtualenv tool, used for creating isolated Python environments, is vulnerable in versions 21.14.8 through 21.14.10 . The app-data seeder can leave an environment linked to temporary package files that are deleted upon completion of the creation process. This occurs because the environment-va...

CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CLSA-2026-1792510471 python-virtualenv: Fix of 2 CVEs

Additional fix for CVE-2024-53899: quote the activate.csh values for csh, so a backslash before a quote cannot end the literal under tcsh's backslashquote and a ! cannot trigger history expansion...

PT-2026-118615

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The download wheel function writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from the textual Saved output of pip. When...

PT-2026-118616

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The builtin creator uses the ensure dir function for executable, library, and package directories. Because exists follows symlinks, ensure dir accepts existing symlinks to directories. If anothe...

PT-2026-118626

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The app-data copy seeder uses the shutil.copy function to copy cached package files into new environments. This process causes cached source modes to override the current run's umask a user...

PT-2026-118627

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description A flaw exists where ViaTemplateActivator. generate only removes existing output if Path.exists is true, which allows a dangling symlink to persist and redirect activation content. Additionally,...

PT-2026-118614

Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.8 through 21.14.9 Description The app-data seeder may leave an environment linked to temporary package files that are deleted upon completion of the creation process. This state can be triggered via environment-variab...

PT-2026-118630

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The safe delete function contains an error handler that responds to failed removals by reading mode bits via os.lstatpath and applying owner-write permissions using os.chmodpath, .... Because...

PT-2026-118628

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description When generating POSIX console scripts, ScriptMakerCustom and pip pass an incompletely quoted interpreter path to the distlib ScriptMaker. If the path contains a space or results in a shebang...

PT-2026-120138

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.4 Description The bash activate script, which is also sourced by zsh, fails to properly escape the environment name. In versions prior to 21.13.0, the name remains unescaped. In versions 21.13.0 through...

PT-2026-120139

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.2 Description The FishActivator component inherits ViaTemplateActivator.quote, which utilizes the POSIX shlex.quote function. Because the fish shell interprets backslashes and single quotes differently than...

PT-2026-118617

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The PipInvoke.get pip install cmd function handles the --seeder pip --download configuration by calling get wheeldownload=False, which allows pip to consult the configured index. This process...

PT-2026-118623

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The stdlib venv creator reads the generated pyvenv.cfg using str.splitlines and merges the parsed keys over the selected configuration. An untrusted caller who can influence the destination...

PT-2026-118625

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description An issue exists where PipInstall. uninstall previous version accepts existing seed-package metadata and uninstall dist joins entries from top level.txt and RECORD to site-packages without...

PT-2026-120140

Name of the Vulnerable Software and Affected Versions virtualenv versions 20.26.6 through 21.14.1 Description The ViaTemplateActivator.instantiate template function replaces placeholders sequentially across the activation template. This allows trigger names like VIRTUAL NAME , VIRTUAL ENV , or...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.7. This vulnerability stems from incomplete escaping of environment variables in the bash activate script; backslashes can be unescaped, allowing commands to be executed in the user’s shell when names...