{"id":"ghsa-ghsa-4f8h-vr72-p32c","seq":661280,"kind":"advisory","title":"virtualenv: Temporary app-data can leave dangling seed package links","url":"https://github.com/advisories/GHSA-4f8h-vr72-p32c","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4f8h-vr72-p32c","summary":"影響: pip:virtualenv >= 21.14.8, < 21.14.10 → 21.14.10\nThe app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. Anthropic's OSS Scanner reported this as ANT-2026-ZOE2GEPC in virtualenv-20261015-005, received on 15 October 2026. T…","severity":"medium","techs":["python"],"cves":["CVE-2026-113713"],"tags":["GHSA-4f8h-vr72-p32c","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:26:57.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}