virtualenv: Seeded files retain permissions from an older cache

影響: pip:virtualenv < 21.14.9 → 21.14.9

The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026. Affected area Permissions of files copied from app-data into a new environment. Attacker-controlled input The cache must contain files created with broade…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 07:23, GitHub Advisory Database에서 "virtualenv: Seeded files retain permissions from an older cache"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-113720.