CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the FromAppData seed mechanism in src/virtualenv/seed/embed/viaappdata/viaappdata.py, when symlinkappdata is enabled against a transient temporary app-data store. In this configuration, virtualenv creates symlinks fro...

PT-2026-120138

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.4 Description The bash activate script, which is also sourced by zsh, fails to properly escape the environment name. In versions prior to 21.13.0, the name remains unescaped. In versions 21.13.0 through...

PT-2026-118615

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The download wheel function writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from the textual Saved output of pip. When...

PT-2026-118617

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The PipInvoke.get pip install cmd function handles the --seeder pip --download configuration by calling get wheeldownload=False, which allows pip to consult the configured index. This process...

PT-2026-118625

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description An issue exists where PipInstall. uninstall previous version accepts existing seed-package metadata and uninstall dist joins entries from top level.txt and RECORD to site-packages without...

PT-2026-118626

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The app-data copy seeder uses the shutil.copy function to copy cached package files into new environments. This process causes cached source modes to override the current run's umask a user...

PT-2026-118627

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description A flaw exists where ViaTemplateActivator. generate only removes existing output if Path.exists is true, which allows a dangling symlink to persist and redirect activation content. Additionally,...

PT-2026-118630

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The safe delete function contains an error handler that responds to failed removals by reading mode bits via os.lstatpath and applying owner-write permissions using os.chmodpath, .... Because...

PT-2026-120140

Name of the Vulnerable Software and Affected Versions virtualenv versions 20.26.6 through 21.14.1 Description The ViaTemplateActivator.instantiate template function replaces placeholders sequentially across the activation template. This allows trigger names like VIRTUAL NAME , VIRTUAL ENV , or...

PT-2026-118623

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The stdlib venv creator reads the generated pyvenv.cfg using str.splitlines and merges the parsed keys over the selected configuration. An untrusted caller who can influence the destination...

PT-2026-118631

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.7 Description The bash activate script fails to properly escape the environment name during the two passes bash performs over the PS1 prompt variable. Consequently, a backslash in the environment name can und...

PT-2026-120139

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.2 Description The FishActivator component inherits ViaTemplateActivator.quote, which utilizes the POSIX shlex.quote function. Because the fish shell interprets backslashes and single quotes differently than...

PT-2026-118614

Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.8 through 21.14.9 Description The app-data seeder may leave an environment linked to temporary package files that are deleted upon completion of the creation process. This state can be triggered via environment-variab...

PT-2026-118628

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description When generating POSIX console scripts, ScriptMakerCustom and pip pass an incompletely quoted interpreter path to the distlib ScriptMaker. If the path contains a space or results in a shebang...

PT-2026-118616

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure dir for executable, library, and package directories, and ensure dir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

Python Packaging Authority virtualenv encryption vulnerability

The Python Packaging Authority virtualenv version 21.14.8 has a security vulnerability. This vulnerability stems from downloadwheel, which downloads the package index into a reusable cache before validating the target based on the Saved output from pip. Due to a flaw in the digest comparison, a...

Security update for python-virtualenv (important)

openSUSE security update: security update for python-virtualenv ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22100-1 Rating: important References: bsc1283890 bsc1283904 Cross-References: CVE-2026-102930 CVE-2026-102938 CVSS scores: CVE-2026-10293...