## virtualenv: Generated files can follow existing destination links

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-113721
- 公開日時: 2026-10-22T17:03:12.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-558c-9hv2-4prj)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-558c-9hv2-4prj

影響: pip:virtualenv < 21.14.9 → 21.14.9
Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported this as ANT-2026-XBEOCBS1 in virtualenv-20261015-005, received on 15 October 2026. Affected area Final file entries written during environment creation and seeding. Attacker-controlled input Another account mu…