CVE-2026-113713

Awaiting Analysis Awaiting Analysis - Queue

Virtualenv Temporary App-Data Symlink Issue

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113713

EUVD

EUVD-2026-105259

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	>= 21.14.8, < 21.14.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

Executive Summary

CVE-2026-113713 is a vulnerability in the virtualenv tool where temporary app-data storage could create dangling package paths. When symlink seeding is enabled via environment variables or configuration files, pip may link to temporary cache files that virtualenv deletes after environment creation. This leaves a broken path that another user could exploit in a shared temporary directory before the original user runs pip again.

Detection Guidance

Check virtualenv version with pip show virtualenv. If version is between 21.14.8 and 21.14.10, the system is vulnerable. Review environment variables and configuration files for symlink_app_data settings. Inspect temporary directories for dangling symlinks pointing to deleted cache paths.

Impact Analysis

An attacker with access to a shared temporary directory could replace the deleted cache pathname with malicious code. This could cause the environment to execute the attacker's code when using affected packages like pip, potentially leading to arbitrary code execution or data compromise.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it involves a local temporary file handling issue in a Python virtual environment tool. The risk is limited to potential code execution if an attacker gains access to a shared temporary directory, which is not a typical compliance violation scenario for these standards.

Mitigation Strategies

Upgrade virtualenv to version 21.14.10 or later. Disable symlink_app_data in environment variables and configuration files. Ensure temporary cache directories are not shared or writable by untrusted users.

Hi! I’m here to help you understand CVE-2026-113713. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...