CVE-2026-113721

Received Received - Intake

Path Traversal in virtualenv Prior to 21.14.9

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account that prepares final entries inside the destination can therefore cause environment creation to create or overwrite files outside the requested tree with constrained virtualenv-generated content and the invoking user's permissions. The destination parent must remain controlled by the environment owner during creation; concurrent parent-directory replacement is a separate concern. This issue is fixed in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113721

EUVD

EUVD-2026-105303

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

CVE-2026-113721 is a vulnerability in virtualenv versions before 21.14.9 where generated files could be redirected via symlinks or hard links to unintended locations. The issue occurs because the tool fails to properly handle dangling symlinks, allowing attackers to manipulate file creation outside the intended environment directory.

Detection Guidance

Check virtualenv version with 'virtualenv --version'. If it is 21.14.8 or earlier, the system is vulnerable. Inspect environment directories for unexpected symlinks or files outside the intended tree using commands like 'find /path/to/venv -type l' or 'ls -la /path/to/venv/bin/'.

Impact Analysis

An attacker could exploit this to overwrite or create files in your home directory or other locations with virtualenv-generated content. This includes sensitive files like .bash_aliases or .bashrc, potentially leading to unauthorized code execution or data manipulation with your user permissions.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later using 'pip install --upgrade virtualenv'. Avoid creating environments over directories controlled by other accounts. Use fresh destination directories under owner-controlled parents.

Hi! I’m here to help you understand CVE-2026-113721. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70