Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-113724: virtualenv may make symlink target writable during delete

CVE-2026-113724 · published 15 days ago

Summary

The virtualenv tool, used to create isolated Python environments, could unintentionally change the permissions on a file that a symbolic link points to when it tries to clean up a failed delete operation. If an attacker can place a symlink inside a read‑only folder, the target file may become writable for the attacker’s user account, potentially allowing further changes. Upgrade virtualenv to version 21.14.9 or later to stop this behavior.

What to do

Update virtualenv to version 21.14.9.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	pypa	virtualenv	< 21.14.9
pip	–	virtualenv	< 21.14.9 Fix: upgrade to 21.14.9
Debian:12	debian	python-virtualenv	All versions
Ubuntu:14.04:LTS	canonical	python-virtualenv	All versions

Original advisory text

virtualenv: Deletion recovery can change a symlink target's mode

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can therefore cause a victim-owned target outside the destination that is initially not writable by the invoking user to become broadly writable before the retry fails, provided that user owns the target and can change its mode. Another account can use the widened mode only if it can traverse the target's parent directories; root does not reach the demonstrated failure path, and the operation does not itself read the target. This issue is fixed in version 21.14.9.

References

https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c4... Patch
https://github.com/pypa/virtualenv/pull/3427 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-1137... Vendor Advisory
https://github.com/advisories/GHSA-43mp-35q3-x3fq
https://github.com/pypa/virtualenv/releases/tag/21.14.9 URL
https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-113724 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-113724 Vendor Advisory
https://ubuntu.com/security/CVE-2026-113724 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-113724 Third Party Advisory
https://github.com/pypa/virtualenv Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-59Link Following

Timeline

Published20 Oct 2026

Updated4 Nov 2026

First seen20 Oct 2026

Sources

CVE-2026-113724 · NVD

CVE-2026-113724 · MITRE

CVE-2026-113724 · OSV

GHSA-43mp-35q3-x3fq · GHSA

DEBIAN-CVE-2026-113724 · OSV

UBUNTU-CVE-2026-113724 · OSV

GHSA-43mp-35q3-x3fq · OSV

Track software like this

Free during beta