virtualenv: Builtin creation follows linked environment directories

影響: pip:virtualenv < 21.14.9 → 21.14.9

The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15 October 2026. Affected area Directory preparation before environment files are created. Attacker-controlled input Another account must be able to prepare linked entries below the chosen destination before crea…

GitHub Advisory Databaseで読む

2026/10/22 06:35、GitHub Advisory Databaseが「virtualenv: Builtin creation follows linked environment directories」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-113716。