CVE-2026-113720

Received Received - Intake

Permission Bypass in virtualenv via Umask Override

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113720

EUVD

EUVD-2026-105302

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability affects virtualenv, a tool for creating isolated Python environments. It occurs when files copied from a cache retain permissions from an older, potentially permissive umask. The app-data copy seeder uses shutil.copy, which preserves file modes from the cache regardless of the current umask. If the cache was created with broad permissions, files copied into a new environment may retain those permissions, allowing unintended access by other local accounts.

Detection Guidance

Check virtualenv version with pip show virtualenv or virtualenv --version. If version is below 21.14.9, the system is vulnerable. Inspect file permissions in virtualenv environments, especially in cache directories, for overly permissive settings like 0666 or 0777.

Impact Analysis

An attacker with access to traverse the environment's parent directories could exploit this to modify files, such as appending code to pip/__init__.py, which would execute with the environment owner's privileges. This could lead to arbitrary code execution or data tampering within the virtual environment.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later using pip install --upgrade virtualenv. Verify the upgrade with pip show virtualenv. Recreate any existing virtual environments to ensure proper permissions are applied.

Hi! I’m here to help you understand CVE-2026-113720. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70