## virtualenv: Seeded files retain permissions from an older cache

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-113720
- 公開日時: 2026-10-23T22:23:11.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-fc2g-4w5p-6whm)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-fc2g-4w5p-6whm

影響: pip:virtualenv < 21.14.9 → 21.14.9
The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026. Affected area Permissions of files copied from app-data into a new environment. Attacker-controlled input The cache must contain files created with broade…