{"id":"ghsa-ghsa-558c-9hv2-4prj","seq":309547,"kind":"advisory","title":"virtualenv: Generated files can follow existing destination links","url":"https://github.com/advisories/GHSA-558c-9hv2-4prj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-558c-9hv2-4prj","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nGenerated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported this as ANT-2026-XBEOCBS1 in virtualenv-20261015-005, received on 15 October 2026. Affected area Final file entries written during environment creation and seeding. Attacker-controlled input Another account mu…","severity":"medium","techs":["python"],"cves":["CVE-2026-113721"],"tags":["GHSA-558c-9hv2-4prj","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T17:03:12.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}