{"id":"ghsa-ghsa-cw65-gx24-rc82","seq":96664,"kind":"advisory","title":"virtualenv: Builtin creation follows linked environment directories","url":"https://github.com/advisories/GHSA-cw65-gx24-rc82","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cw65-gx24-rc82","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nThe builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15 October 2026. Affected area Directory preparation before environment files are created. Attacker-controlled input Another account must be able to prepare linked entries below the chosen destination before crea…","severity":"medium","techs":["python"],"cves":["CVE-2026-113716"],"tags":["GHSA-cw65-gx24-rc82","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T21:35:56.000Z","fetched_at":"2026-10-22T00:22:51.452Z"}