CVE-2026-113716
Received Received - Intake

Symlink Directory Traversal in virtualenv

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination when another local account prepared the tree and the invoking user can access the target. The --clear option removes the planted tree first, while ordinary creation reaches it; arbitrary attacker-selected output bytes are not established. This issue is fixed in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-21
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113716
EUVD
EUVD-2026-105297

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pypa virtualenv < 21.14.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113716 is a vulnerability in the virtualenv tool prior to version 21.14.9. It involves the builtin creator accepting existing directory symlinks through the ensure_dir() function, which follows symlinks. This allows writes outside the intended destination directory when another local account prepares the tree and the invoking user can access the target. The vulnerability enables planting executable files on the user's PATH, leading to potential execution of attacker-controlled code.

Detection Guidance

Check virtualenv version with pip show virtualenv. If version is 21.14.8 or earlier, the system is vulnerable. Inspect environment directories (bin, lib, lib64) for symlinks or junctions pointing outside the intended path. Use commands like ls -la /path/to/env/bin to list symlinks.

Impact Analysis

An attacker could exploit this to write arbitrary files outside the intended virtual environment directory. This includes planting executables in directories like ~/.local/bin, which could execute malicious code when run by the user. The impact is limited to local attacks requiring some access to the system.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later using pip install --upgrade virtualenv. Remove any existing virtual environments created with vulnerable versions and recreate them. Avoid using --clear option as it may not fully mitigate the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113716. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart