Permission Vulnerability in virtualenv by Python Packaging Authority

CVE-2026-113724

What is CVE-2026-113724?

The virtualenv tool, used for creating isolated Python environments, has a vulnerability in its safe_delete() function. Prior to version 21.14.9, the function improperly handles deletion errors by reading the mode bits from a symlink, which can lead to the owner of a target file being granted broader write permissions than intended. This occurs when a malicious link is planted inside a read-only directory. If the victim user owns the target file, they could inadvertently allow modifications to it, potentially by other accounts able to traverse its parent directories. This vulnerability was addressed in version 21.14.9, emphasizing the need for users to update to the latest version to maintain system security.

References