virtualenv: Temporary app-data can leave dangling seed package links
影響: pip:virtualenv >= 21.14.8, < 21.14.10 → 21.14.10
The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. Anthropic's OSS Scanner reported this as ANT-2026-ZOE2GEPC in virtualenv-20261015-005, received on 15 October 2026. T…
| CVE | CVE-2026-113713 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/24 13:50 |
| データ | Markdown JSON |
2026/10/24 07:26、GitHub Advisory Databaseが「virtualenv: Temporary app-data can leave dangling seed package links」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-113713。