Local File Overwrite Vulnerability in Virtual Environment Tool by PyPa

CVE-2026-113721

What is CVE-2026-113721?

The Virtualenv tool for creating isolated Python environments contains a vulnerability that allows for potential local file overwrites. In versions prior to 21.14.9, the method _generate() may retain a dangling symbolic link under certain conditions, enabling unauthorized modification of files outside the intended virtual environment path. Specifically, when a local account prepares entries within the destination, it can lead to unexpected file creation or overwriting with contents generated by Virtualenv. Users are advised to upgrade to version 21.14.9 to mitigate this risk and ensure their environments are secure.

References