virtualenv: Builtin creation follows linked environment directories

影響: pip:virtualenv < 21.14.9 → 21.14.9

The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15 October 2026. Affected area Directory preparation before environment files are created. Attacker-controlled input Another account must be able to prepare linked entries below the chosen destination before crea…

在 GitHub Advisory Database 阅读

2026/10/22 06:35，GitHub Advisory Database 发布了“virtualenv: Builtin creation follows linked environment directories”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-113716。