GHSA-43MP-35Q3-X3FQ virtualenv: Deletion recovery can change a symlink target's mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...

virtualenv: Deletion recovery can change a symlink target's mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...

EUVD-2026-105272

virtualenv: Deletion recovery can change a symlink target's mode...

CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

CVE-2026-113724 virtualenv: Deletion recovery can change a symlink target's mode

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

CVE-2026-113724

The virtualenv tool, used for creating isolated Python environments, is vulnerable to a symlink-following issue in versions prior to 21.14.9 . The safe_delete() deletion error handler uses os.lstat(path) to read mode bits and os.chmod(path, ...) to apply owner-write permissions. Because these ope...