virtualenv: Temporary app-data can leave dangling seed package links
影響: pip:virtualenv >= 21.14.8, < 21.14.10 → 21.14.10
The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. Anthropic's OSS Scanner reported this as ANT-2026-ZOE2GEPC in virtualenv-20261015-005, received on 15 October 2026. T…
Read on GitHub Advisory Database
| CVE | CVE-2026-113713 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/24/2026, 01:50 PM |
| Data | Markdown JSON |
On 10/24/2026, 07:26 AM, GitHub Advisory Database published "virtualenv: Temporary app-data can leave dangling seed package links" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-113713.