virtualenv: Seeded files retain permissions from an older cache

影響: pip:virtualenv < 21.14.9 → 21.14.9

The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026. Affected area Permissions of files copied from app-data into a new environment. Attacker-controlled input The cache must contain files created with broade…

Read on GitHub Advisory Database

On 10/24/2026, 07:23 AM, GitHub Advisory Database published "virtualenv: Seeded files retain permissions from an older cache" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-113720.