virtualenv: Generated files can follow existing destination links
影響: pip:virtualenv < 21.14.9 → 21.14.9
Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported this as ANT-2026-XBEOCBS1 in virtualenv-20261015-005, received on 15 October 2026. Affected area Final file entries written during environment creation and seeding. Attacker-controlled input Another account mu…
Read on GitHub Advisory Database
| CVE | CVE-2026-113721 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/23/2026, 05:09 AM |
| Data | Markdown JSON |
On 10/23/2026, 02:03 AM, GitHub Advisory Database published "virtualenv: Generated files can follow existing destination links" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-113721.