virtualenv: Temporary app-data can leave dangling seed package links

影響: pip:virtualenv >= 21.14.8, < 21.14.10 → 21.14.10

The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. Anthropic's OSS Scanner reported this as ANT-2026-ZOE2GEPC in virtualenv-20261015-005, received on 15 October 2026. T…

在 GitHub Advisory Database 阅读

2026/10/24 07:26，GitHub Advisory Database 发布了“virtualenv: Temporary app-data can leave dangling seed package links”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-113713。