virtualenv: Builtin creation follows linked environment directories

影響: pip:virtualenv < 21.14.9 → 21.14.9

The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15 October 2026. Affected area Directory preparation before environment files are created. Attacker-controlled input Another account must be able to prepare linked entries below the chosen destination before crea…

GitHub Advisory Database에서 읽기

2026. 10. 22. 오전 06:35, GitHub Advisory Database에서 "virtualenv: Builtin creation follows linked environment directories"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-113716.