BIT-VIRTUALENV-2026-113724 virtualenv: Deletion recovery can change a symlink target's mode

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

SUSE CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

Linux Distros Unpatched Vulnerability : CVE-2026-113724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by...

Virtualenv: Deletion Recovery Can Change A Symlink Target's Mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as "ANT-2026-UK90QC27" in "virtualenv-20261015-005...

GHSA-43MP-35Q3-X3FQ virtualenv: Deletion recovery can change a symlink target's mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...

virtualenv: Deletion recovery can change a symlink target's mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...

EUVD-2026-105272

virtualenv: Deletion recovery can change a symlink target's mode...

CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

AZL-111521 CVE-2026-113724 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

DEBIAN-CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

CVE-2026-113724 virtualenv: Deletion recovery can change a symlink target's mode

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

CVE-2026-113724

The virtualenv tool, used for creating isolated Python environments, is vulnerable to a symlink-following issue in versions prior to 21.14.9 . The safe_delete() deletion error handler uses os.lstat(path) to read mode bits and os.chmod(path, ...) to apply owner-write permissions. Because these ope...

CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

CVE-2026-113724 virtualenv: Deletion recovery can change a symlink target's mode

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

Python Packaging Authority virtualenv post-link vulnerability

The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a post-release vulnerability. This vulnerability stems from the handling of errors during the safedelete function’s deletion operations. When deletion fails, the error handling code uses os.lstatpath to read the file mode...