Vulnerability in Virtualenv Tool Affecting Package Management
CVE-2026-113713

4.4MEDIUM

Key Information:

Vendor

Pypa

Status
Virtualenv
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113713?

The virtualenv tool, used to create isolated Python environments, contains a vulnerability that affects versions 21.14.8 to 21.14.10. When utilizing the app-data seeder, temporary package files may remain linked to an environment even after the creation process is complete. This can lead to environments depending on cache paths that the owner no longer controls due to configurations allowing symlink_app_data. Users are advised to upgrade to version 21.14.10 to mitigate this risk.

Affected Version(s)

virtualenv >= 21.14.8, < 21.14.10

References

https://github.com/pypa/virtualenv/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pypa/virtualenv/pull/3437
x_refsource_MISC
https://github.com/pypa/virtualenv/commit/b81995c3feab9e1...
x_refsource_MISC

CVSS V4

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.