Symlink Vulnerability in Python Virtual Environment Tool by pypa

CVE-2026-113716

What is CVE-2026-113716?

The Python virtual environment tool, virtualenv, is susceptible to a symlink vulnerability prior to version 21.14.9. This flaw arises from the builtin creator's handling of directory paths, where it inappropriately accepts existing symlinks in executable, library, and package directories. As a result, when an interpreter is created or activated, the tool may inadvertently write to linked parent directories outside the intended destination. This occurs under circumstances where a different local user has prepared the directory structure. To mitigate this risk, users are advised to update to version 21.14.9 or later, which addresses the symlink handling and prevents unauthorized access to the linked parent directories.

References