virtualenv: Seeded files retain permissions from an older cache

影響: pip:virtualenv < 21.14.9 → 21.14.9

The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026. Affected area Permissions of files copied from app-data into a new environment. Attacker-controlled input The cache must contain files created with broade…

GitHub Advisory Databaseで読む

2026/10/24 07:23、GitHub Advisory Databaseが「virtualenv: Seeded files retain permissions from an older cache」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-113720。