File Permission Vulnerability in Virtualenv by Python Packaging Authority

CVE-2026-113720

What is CVE-2026-113720?

The vulnerability in virtualenv allows cached source files to be unintentionally made writable under permissive umask settings. Prior to version 21.14.9, when the app-data copy seeder utilizes shutil.copy(), it may transfer cached files into a later environment with altered permissions. This introduces a risk where files in a traversable environment could potentially be altered and executed by unauthorized local accounts. While attackers cannot manipulate the initial umask directly, a private parent directory can prevent access, mitigating some risks. This issue was effectively addressed in version 21.14.9, enhancing the overall security of virtualenv.

References