virtualenv: Generated files can follow existing destination links

影響: pip:virtualenv < 21.14.9 → 21.14.9

Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported this as ANT-2026-XBEOCBS1 in virtualenv-20261015-005, received on 15 October 2026. Affected area Final file entries written during environment creation and seeding. Attacker-controlled input Another account mu…

在 GitHub Advisory Database 阅读

2026/10/23 02:03，GitHub Advisory Database 发布了“virtualenv: Generated files can follow existing destination links”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-113721。