virtualenv: Generated files can follow existing destination links
影響: pip:virtualenv < 21.14.9 → 21.14.9
Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported this as ANT-2026-XBEOCBS1 in virtualenv-20261015-005, received on 15 October 2026. Affected area Final file entries written during environment creation and seeding. Attacker-controlled input Another account mu…
| CVE | CVE-2026-113721 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/23 05:09 |
| データ | Markdown JSON |
2026/10/23 02:03、GitHub Advisory Databaseが「virtualenv: Generated files can follow existing destination links」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-113721。