virtualenv: Seeded files retain permissions from an older cache

影響: pip:virtualenv < 21.14.9 → 21.14.9

The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026. Affected area Permissions of files copied from app-data into a new environment. Attacker-controlled input The cache must contain files created with broade…

在 GitHub Advisory Database 阅读

2026/10/24 07:23，GitHub Advisory Database 发布了“virtualenv: Seeded files retain permissions from an older cache”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-113720。