CVE-2026-113724

The virtualenv tool, used for creating isolated Python environments, is vulnerable to a symlink-following issue in versions prior to 21.14.9 . The safe_delete() deletion error handler uses os.lstat(path) to read mode bits and os.chmod(path, ...) to apply owner-write permissions. Because these ope...

CVE-2026-113724 virtualenv: Deletion recovery can change a symlink target's mode

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...