{"id":"ghsa-ghsa-fc2g-4w5p-6whm","seq":661284,"kind":"advisory","title":"virtualenv: Seeded files retain permissions from an older cache","url":"https://github.com/advisories/GHSA-fc2g-4w5p-6whm","permalink":"https://vulnpulse.app/items/ghsa-ghsa-fc2g-4w5p-6whm","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nThe app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026. Affected area Permissions of files copied from app-data into a new environment. Attacker-controlled input The cache must contain files created with broade…","severity":"medium","techs":["python"],"cves":["CVE-2026-113720"],"tags":["GHSA-fc2g-4w5p-6whm","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:23:11.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}